An out‑of‑bounds write occurs in the ALSA USB‑MIDI novation output routine when a device advertises a wMaxPacketSize of 1. The kernel code incorrectly accepts a negative count and passes it to a memcpy, causing memory corruption on the USB bulk OUT transfer buffer. This results in the kernel writing past the allocated buffer, potentially corrupting memory and allowing a malicious USB device to execute arbitrary code or crash the system. The flaw falls under the buffer overflow weakness.

This issue affects Linux kernel implementations that include the ALSA usb‑audio subsystem, specifically the snd_usbmidi_novation_output function. It is relevant for any distribution using the standard Linux kernel with ALSA USB‑MIDI drivers, regardless of version, whenever a USB device can provide a bulk OUT endpoint with a wMaxPacketSize of 1. No specific version ranges are enumerated, so all affected kernels currently in use are vulnerable until the patch is applied.

The vulnerability is a kernel‑space buffer overflow that can be triggered by a correctly crafted USB MIDI device presented to the system. Because the attacker must supply a malicious device, the attack vector is local/physical but can be accessed via USB port, thus considered a high‑risk local exploitation. No EPSS score is provided, but kernel overflows typically carry high likelihood if an attack is mounted. The CVE has not appeared in CISA KEV, and no public exploit is known, but the severity of the flaw warrants immediate remediation.