---
id: CVE-2026-52964
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans

  The USB MIDI 2.0 endpoint parser has the same descriptor walking
  pattern as the legacy MIDI parser
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans

  The USB MIDI 2.0 endpoint parser has the same descriptor walking
  pattern as the legacy MIDI parser. It valida…
severity: none
published: '2026-06-24'
updated: '2026-07-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52964'
references:
  - url: 'https://git.kernel.org/stable/c/17e76b19de1aff5ff4de64d269290bd1b07a01d3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/918be519c7876329e1b6e2ea1c59f0b75e792dca'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a310b4bebda5e4a1b26520c0cc5145ccd6d617e2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f9c184a83574549a36ea69b755f650e57d164c78'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fafc97bd01e4c737eaeafadfdadb1af4bbfa7307'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00162
epssPercentile: 0.04585
ingestedAt: '2026-07-11T13:13:24.979Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans

The USB MIDI 2.0 endpoint parser has the same descriptor walking
pattern as the legacy MIDI parser. It validates bLength against
bNumGrpTrmBlock before reading baAssoGrpTrmBlkID[], but not against the
remaining bytes in the endpoint-extra scan.

A malformed device can therefore make later baAssoGrpTrmBlkID[] reads
consume bytes past the walked descriptor.

Reject zero-length and overlong descriptors while walking endpoint
extras.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.