CVE-2026-98770: Linux Kernel USB Gadget Buffer Overflow

CVE-2026-98770 is a buffer overflow flaw in Linux kernel USB gadget MIDI2 driver affecting jack descriptor arrays. The vulnerability can cause out-of-bounds access when configuring multiple jacks. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-98770 Overview

CVE-2026-98770 is a Linux kernel vulnerability in the USB gadget MIDI2 subsystem. The flaw affects the f_midi2_usb_config structure, where the jack input and output descriptor arrays are undersized. The arrays were allocated with MAX_CABLES elements, but the code populates entries for both input and output jacks within a single loop iteration. This mismatch doubles the required array capacity and can produce an out-of-bounds (OOB) write when configfs is used to configure a large number of jacks.

Critical Impact
An out-of-bounds memory access in the USB gadget MIDI2 driver can corrupt adjacent kernel memory when userspace creates many MIDI jacks via configfs, potentially leading to kernel instability or memory corruption.

Affected Products

Linux kernel versions containing the USB gadget MIDI2 driver (drivers/usb/gadget/function/f_midi2.c)
Distributions shipping the vulnerable f_midi2_usb_config structure prior to the fix
Systems exposing USB gadget functionality through configfs

Discovery Timeline

2026-10-18 - CVE-2026-98770 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98770

Vulnerability Analysis

The vulnerability resides in the USB gadget MIDI 2.0 function driver. The struct f_midi2_usb_config defines two descriptor arrays, jack_ins and jack_outs, each sized to hold MAX_CABLES entries. During initialization the driver iterates over configured cables and, for each iteration, appends descriptor entries for both input and output endpoints into the same arrays. The result is two entries added per cable, requiring MAX_CABLES * 2 slots.

When userspace creates the maximum number of cables through configfs, the write index exceeds the allocated array bounds. This produces out-of-bounds writes into adjacent fields of the containing structure, classified as an Out-of-Bounds Write condition.

Root Cause

The root cause is an array sizing inconsistency between declaration and usage. The developer assumed one entry per cable, but the loop body populates two. The upstream fix doubles both arrays to MAX_CABLES * 2, matching the actual write pattern.

Attack Vector

Exploitation requires local access to a system that exposes USB gadget configfs with the MIDI2 function. An unprivileged or privileged user with permission to configure gadget functions can trigger the overflow by instantiating a sufficient number of jacks. Impact is limited to systems where USB gadget mode and configfs access are enabled, which is common on embedded Linux devices, developer boards, and Android-derived platforms.

See the upstream fixes for implementation detail: Kernel commit 310c2d4, commit 87f2185, and commit 8294ff7.

Detection Methods for CVE-2026-98770

Indicators of Compromise

Unexpected kernel oops or panic messages referencing f_midi2, jack_ins, or jack_outs in dmesg output.
KASAN reports flagging out-of-bounds writes within the USB gadget MIDI2 function during configfs operations.
Repeated configfs operations under /sys/kernel/config/usb_gadget/*/functions/midi2.* creating large numbers of jack entries.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to catch OOB writes in the MIDI2 driver before production exposure.
Audit running kernels against patched stable versions by comparing against the upstream fix commits.
Monitor configfs activity for abnormal volumes of USB gadget function creation events on devices that permit userspace gadget configuration.

Monitoring Recommendations

Collect and centralize dmesg and /var/log/kern.log from Linux endpoints to surface kernel warnings tied to the USB gadget stack.
Alert on process executions that write to /sys/kernel/config/usb_gadget/ from non-administrative accounts.
Track kernel package versions across the fleet to confirm patch deployment status.

How to Mitigate CVE-2026-98770

Immediate Actions Required

Update to a Linux kernel version that includes the fix commits listed in the kernel.org references.
Disable the USB gadget MIDI2 function (CONFIG_USB_F_MIDI2) on systems that do not require USB MIDI 2.0 gadget capability.
Restrict access to configfs mount points so that only trusted administrative accounts can define gadget functions.

Patch Information

The fix enlarges jack_ins and jack_outs in struct f_midi2_usb_config to MAX_CABLES * 2, aligning array capacity with the loop that populates two entries per cable. Patches are available across multiple stable branches: commit 18138d9, commit 223c3bd, commit 310c2d4, commit 8294ff7, and commit 87f2185. Apply distribution kernel updates when available.

Workarounds

Unload the f_midi2 module (modprobe -r f_midi2) on systems where USB MIDI 2.0 gadget functionality is not needed.
Unmount configfs or restrict its permissions (chmod 700 /sys/kernel/config) to prevent unprivileged jack creation.
Limit the number of MIDI cables configured per gadget instance to stay well below MAX_CABLES until patched kernels are deployed.