Out-of-bounds write in Linux kernel - CVE-2026-74499

Vulnerability details

The vulnerability allows an attacker with physical access to cause a denial of service or execute arbitrary code.

The vulnerability exists due to out-of-bounds write in snd_usbmidi_akai_output() when processing MIDI output for a USB device advertising a tiny bulk-OUT endpoint. An attacker with physical access can connect a crafted USB device and trigger a write to the created MIDI device node to cause a denial of service or execute arbitrary code.

The issue is caused by a signed-to-unsigned conversion in the fill-loop bound calculation, making the loop continue writing past the end of the URB transfer buffer.

Affected software

How to mitigate CVE-2026-74499

External References

• https://git.kernel.org/stable/c/0970274613fb463d376211450cab066d34ebfe6a
• https://git.kernel.org/stable/c/29a4c29943631301e85f5e9d10f25741bd78e7ba
• https://git.kernel.org/stable/c/2b7a0f330dd90dd1a7657cec0db019ee1efa4372
• https://git.kernel.org/stable/c/9b22a5c8310b0d55d04f5f0159b913a2fb8b444f
• https://git.kernel.org/stable/c/b5305a0d0bb8e90a6fc9f88270d5f6c9b8c40081

Related Security Bulletins

• Out-of-bounds write in Linux kernel usb
• Debian update for linux