SB20260912400 - Out-of-bounds read in Linux kernel usb 6fire

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-80973)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose kernel memory.

The vulnerability exists due to an out-of-bounds read in usb6fire_comm_receiver_handler() when processing MIDI events from a connected USB device. An attacker with physical access can provide a MIDI event with an excessive length value to disclose kernel memory.

The receiver is submitted during device probing, and forwarding data through the rawmidi read path requires an open MIDI input substream.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2a6f6fba3bd31d2e8c957fefa29156e35e5e75d5
• https://git.kernel.org/stable/c/34816e2cfeabafb8eccf54687186ce25699e8363
• https://git.kernel.org/stable/c/466e911bbbbb779bb06337e35a286e5ca7af16b3
• https://git.kernel.org/stable/c/a478893b59e36cfe7d77a76b352f2db55502e879