{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52963", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.374Z", "datePublished": "2026-06-24T16:28:43.593Z", "dateUpdated": "2026-06-24T16:28:43.593Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-24T16:28:43.593Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Bound MIDI endpoint descriptor scans\n\nsnd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint\ndescriptor size before using baAssocJackID[], but the descriptor walker can\nstill return a class-specific endpoint descriptor whose bLength exceeds the\nremaining bytes in the endpoint-extra scan.\n\nThat leaves later flexible-array reads bounded by bLength, but not by the\nremaining bytes in the endpoint-extra scan.\n\nStop walking when bLength is zero or\nextends past the remaining endpoint-extra scan."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/midi.c"], "versions": [{"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb", "lessThan": "e2f1260a056eb3215c13c48c5378f3e4112dc3af", "status": "affected", "versionType": "git"}, {"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb", "lessThan": "c65b137d351e21cbc5630e73ef0eb1e1d75f5b20", "status": "affected", "versionType": "git"}, {"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb", "lessThan": "728ab0c72e49ca27185067984cd565425eb69b2e", "status": "affected", "versionType": "git"}, {"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb", "lessThan": "3d3b2b01a3e73828e201ece96f863e7a3e0cdc6e", "status": "affected", "versionType": "git"}, {"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb", "lessThan": "a0226560540c16717efcceaf15c862cf115b01d3", "status": "affected", "versionType": "git"}, {"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb", "lessThan": "09141583bd97f4bbd7358e29fd138fe798467cdb", "status": "affected", "versionType": "git"}, {"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb", "lessThan": "c59159ce10e75b568cd0d4b29efcb0fb0ddecc94", "status": "affected", "versionType": "git"}, {"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb", "lessThan": "d6854daa67be623860f4e1873fd3d3c275aba4ed", "status": "affected", "versionType": "git"}, {"version": "9e0c71f2f633b0442661966228827d1a33df485f", "status": "affected", "versionType": "git"}, {"version": "0868bc5654c07628c421547f0821650a8c2cb8f3", "status": "affected", "versionType": "git"}, {"version": "78483c1c7741ffa72991d93d19a75bfdcc2cbf57", "status": "affected", "versionType": "git"}, {"version": "65d95462001c6ccd9bc9499c1fc9a90eca9de496", "status": "affected", "versionType": "git"}, {"version": "ca767cf0152d18fc299cde85b18d1f46ac21e1ba", "status": "affected", "versionType": "git"}, {"version": "4.4.238", "lessThan": "4.5", "status": "affected", "versionType": "semver"}, {"version": "4.9.238", "lessThan": "4.10", "status": "affected", "versionType": "semver"}, {"version": "4.14.200", "lessThan": "4.15", "status": "affected", "versionType": "semver"}, {"version": "4.19.149", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.69", "lessThan": "5.5", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/midi.c"], "versions": [{"version": "5.7", "status": "affected"}, {"version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.6.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.238"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.238"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.200"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.149"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.69"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e2f1260a056eb3215c13c48c5378f3e4112dc3af"}, {"url": "https://git.kernel.org/stable/c/c65b137d351e21cbc5630e73ef0eb1e1d75f5b20"}, {"url": "https://git.kernel.org/stable/c/728ab0c72e49ca27185067984cd565425eb69b2e"}, {"url": "https://git.kernel.org/stable/c/3d3b2b01a3e73828e201ece96f863e7a3e0cdc6e"}, {"url": "https://git.kernel.org/stable/c/a0226560540c16717efcceaf15c862cf115b01d3"}, {"url": "https://git.kernel.org/stable/c/09141583bd97f4bbd7358e29fd138fe798467cdb"}, {"url": "https://git.kernel.org/stable/c/c59159ce10e75b568cd0d4b29efcb0fb0ddecc94"}, {"url": "https://git.kernel.org/stable/c/d6854daa67be623860f4e1873fd3d3c275aba4ed"}], "title": "ALSA: usb-audio: Bound MIDI endpoint descriptor scans", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{}

{"bugzilla": {"description": "kernel: ALSA: usb-audio: Bound MIDI endpoint descriptor scans", "id": "2492331", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492331"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: usb-audio: Bound MIDI endpoint descriptor scans\nsnd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint\ndescriptor size before using baAssocJackID[], but the descriptor walker can\nstill return a class-specific endpoint descriptor whose bLength exceeds the\nremaining bytes in the endpoint-extra scan.\nThat leaves later flexible-array reads bounded by bLength, but not by the\nremaining bytes in the endpoint-extra scan.\nStop walking when bLength is zero or\nextends past the remaining endpoint-extra scan.", "A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) USB audio driver. The driver's handling of MIDI (Musical Instrument Digital Interface) endpoint descriptors did not properly bound scans, allowing it to read beyond the intended memory buffer. This out-of-bounds read could potentially lead to information disclosure or cause system instability."], "name": "CVE-2026-52963", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-52963\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-52963\nhttps://lore.kernel.org/linux-cve-announce/2026062437-CVE-2026-52963-2264@gregkh/T"], "threat_severity": "Moderate"}