SB20261022380 - Out-of-bounds write in Linux kernel gadget function driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-98770)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the USB MIDI gadget driver's jack descriptor arrays in struct f_midi2_usb_config when configuring a large number of jacks via configfs. A local privileged user can configure enough input and output jacks to exceed the array capacities and corrupt adjacent kernel memory, potentially causing a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/18138d9f19cf6944ff09f5c8c0930545036fe3d0
• https://git.kernel.org/stable/c/223c3bd02a582776d8ee47dae7b69d3258420694
• https://git.kernel.org/stable/c/310c2d4608d8c1a2baa57db1dfd319c5c40cf4a1
• https://git.kernel.org/stable/c/8294ff75a9de23f7cc641e5e5ca31fa6ea72a574
• https://git.kernel.org/stable/c/87f2185423e01f113811301878f2f67eccec960d