{"apiVersion":"1.0","identifier":"CVE-2026-74499","description":"In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() snd_usbmidi_akai_output() computes its fill-loop bound buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1; as a signed int, so a small device-advertised bulk-OUT max_transfer makes buf_end negative. The loop guard then compares the u32 urb->transfer_buffer_length against that negative int: the usual arithmetic conversion turns buf_end into a large unsigned value, so the guard stays true and each iteration keeps appending SysEx framing and payload bytes past the end of the URB transfer buffer, which is only max_transfer bytes long. A USB device that advertises a tiny bulk-OUT endpoint can therefore trigger an attacker-length- and content-controlled heap out-of-bounds write when a process writes to the created /dev/snd/midiC*D* node. Return early when there is no room for even one SysEx, so the loop is never entered with a bound that would wrap. The loop is the last statement of the function, so bailing out is equivalent to it not running. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>","publishedAt":"2026-08-15T13:17:54","lastModifiedAt":"2026-08-19T17:21:07","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74499","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00177,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74499","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74499","en":"https://www.redsauce.net/en/cves/CVE-2026-74499","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74499","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74499","de":"https://www.redsauce.net/de/cves/CVE-2026-74499","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74499","el":"https://www.redsauce.net/el/cves/CVE-2026-74499"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74499"}}