The ALSA usb-audio driver contains a logic error in which the buffer end bound is calculated with a signed integer. When a USB device advertises a very small bulk-OUT endpoint, the computed value becomes negative. The loop guard then compares a 32‑bit unsigned transfer length against this negative bound, which after type conversion turns into a very large unsigned number. As the loop iterates, SysEx framing and payload data are written past the end of the URB transfer buffer, resulting in a heap out-of-bounds write that can be exploited to corrupt kernel memory.

All Linux kernel installations that include the ALSA usb‑audio driver and have not yet applied the patch associated with the commit referenced in the advisory are affected. No explicit vendor or kernel version list is provided, so the vulnerability applies to any kernel prior to the fix, including typical distribution kernels that have not incorporated the change.

Exploitation requires a malicious USB device that advertises an abnormally small bulk‑OUT endpoint and interaction with the corresponding /dev/snd/midiC*D* node; therefore the likely attack vector is a local or physical attacker with access to a USB port. The CVSS score is 7.0, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. This medium-to-high severity, combined with low exploitation probability, still means an attacker who can supply a malicious USB device could cause memory corruption, potentially enabling privilege escalation or denial of service. The patch returns early to prevent the buffer overflow.