Log in Start free

Vulnerability · Published Jun 24, 2026 · Assigned by Linux

CVE-2026-52964ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 94.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans The USB MIDI 2.0 endpoint parser has the same descriptor walking pattern as the legacy MIDI parser. It validates bLength against bNumGrpTrmBlock before reading baAssoGrpTrmBlkID[], but not against the remaining bytes in the endpoint-extra scan. A malformed device can therefore make later baAssoGrpTrmBlkID[] reads consume bytes past the walked descriptor. Reject zero-length and overlong descriptors while walking endpoint extras.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.12.94-1DEBIAN-CVE-2026-52964
Debian:14linux7.0.10-1DEBIAN-CVE-2026-52964
Ubuntu:24.04:LTSlinux6.8.0-136.136UBUNTU-CVE-2026-52964
Ubuntu:25.10linuxno fix listedUBUNTU-CVE-2026-52964
Ubuntu:26.04:LTSlinux7.0.0-28.28UBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-aws6.8.0-1061.64UBUNTU-CVE-2026-52964
Ubuntu:25.10linux-awsno fix listedUBUNTU-CVE-2026-52964
Ubuntu:26.04:LTSlinux-aws7.0.0-1009.9UBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1061.64~22.04.1UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-azure6.8.0-1063.71UBUNTU-CVE-2026-52964
Ubuntu:25.10linux-azureno fix listedUBUNTU-CVE-2026-52964
Ubuntu:26.04:LTSlinux-azure7.0.0-1010.10UBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1063.71~22.04.1UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-azure-7.07.0.0-1014.14~24.04.1UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-azure-fde6.8.0-1062.69UBUNTU-CVE-2026-52964
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2026-52964
Ubuntu:26.04:LTSlinux-azure-fde7.0.0-1009.9UBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-azure-fde-6.86.8.0-1062.69~22.04.1UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-azure-fde-7.07.0.0-1013.13~24.04.1UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-gcp6.8.0-1064.72UBUNTU-CVE-2026-52964
Ubuntu:25.10linux-gcpno fix listedUBUNTU-CVE-2026-52964
Ubuntu:26.04:LTSlinux-gcp7.0.0-1008.8UBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1064.72~22.04.1UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-gcp-7.07.0.0-1011.11~24.04.1UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-gke6.8.0-1059.67UBUNTU-CVE-2026-52964
Ubuntu:26.04:LTSlinux-gke7.0.0-1003.4UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1046.50UBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-136.136~22.04.1UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-28.28~24.04.1UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-ibm6.8.0-1061.62UBUNTU-CVE-2026-52964
Ubuntu:26.04:LTSlinux-ibm7.0.0-1010.10UBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1061.62~22.04.1UBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-136.136.2UBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-136.136.2~22.04.1UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1059.62UBUNTU-CVE-2026-52964
Ubuntu:26.04:LTSlinux-nvidia7.0.0-1016.16UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1059.62~22.04.1UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-nvidia-7.07.0.0-1016.16~24.04.1UBUNTU-CVE-2026-52964
Ubuntu:26.04:LTSlinux-nvidia-bos7.0.0-2016.16UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1059.62.1UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1030.31UBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-52964
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1009.9UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-oracle6.8.0-1058.61UBUNTU-CVE-2026-52964
Ubuntu:25.10linux-oracleno fix listedUBUNTU-CVE-2026-52964
Ubuntu:26.04:LTSlinux-oracle7.0.0-1008.8UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1058.61~22.04.1UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-oracle-7.07.0.0-1011.11~24.04.1UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-raspi6.8.0-1061.65UBUNTU-CVE-2026-52964
Ubuntu:25.10linux-raspino fix listedUBUNTU-CVE-2026-52964
Ubuntu:26.04:LTSlinux-raspi7.0.0-1015.15UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-52964
Ubuntu:25.10linux-realtimeno fix listedUBUNTU-CVE-2026-52964
Ubuntu:26.04:LTSlinux-realtime7.0.0-28.28.1UBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-52964
Ubuntu:25.10linux-riscvno fix listedUBUNTU-CVE-2026-52964
Ubuntu:26.04:LTSlinux-riscv7.0.0-28.28.1UBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-136.136~22.04.3UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-riscv-7.07.0.0-28.28.1~24.04.3UBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-52964
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-vmware6.8.0-1008.8UBUNTU-CVE-2026-52964
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1033.34UBUNTU-CVE-2026-52964

Affected products (as reported)

VendorProductVersions
Linux Linux ff49d1df79aef7580fe3ac99d17c3f886655d080 – before fafc97bd01e4c737eaeafadfdadb1af4bbfa7307ff49d1df79aef7580fe3ac99d17c3f886655d080 – before a310b4bebda5e4a1b26520c0cc5145ccd6d617e2ff49d1df79aef7580fe3ac99d17c3f886655d080 – before f9c184a83574549a36ea69b755f650e57d164c78ff49d1df79aef7580fe3ac99d17c3f886655d080 – before 17e76b19de1aff5ff4de64d269290bd1b07a01d3ff49d1df79aef7580fe3ac99d17c3f886655d080 – before 918be519c7876329e1b6e2ea1c59f0b75e792dca
Linux Linux 6.5

References