CVE-2026-80973

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: 6fire: bound the MIDI event length from the device

usb6fire_comm_receiver_handler() forwards a MIDI event using a length

byte the device supplies, with no bound and no check that the transfer

delivered that many bytes:

if (!urb->status) {

if (rt->receiver_buffer[0] == 0x10) /* midi in event */

if (midi_rt)

midi_rt->in_received(midi_rt,

rt->receiver_buffer + 2,

rt->receiver_buffer[1]);

}

receiver_buffer is a 64-byte kzalloc() buffer (COMM_RECEIVER_BUFSIZE), so

only 62 bytes follow the two-byte header. receiver_buffer[1] is a u8 the

device chooses, so a device that answers with 0x10 and a length of 0xFF

makes snd_rawmidi_receive() read 255 bytes starting two bytes into a

64-byte object. The bytes past the buffer are handed to userspace

through the rawmidi read path.

urb->actual_length is not consulted either, so a short transfer leaves

both the type byte and the length byte at their pr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References