CVE-2026-80973 - Vulnerability Details

- ALSA: 6fire: bound the MIDI event length from the device

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: 6fire: bound the MIDI event length from the device

usb6fire_comm_receiver_handler() forwards a MIDI event using a length
byte the device supplies, with no bound and no check that the transfer
delivered that many bytes:

if (!urb->status) {
if (rt->receiver_buffer[0] == 0x10) /* midi in event */
if (midi_rt)
midi_rt->in_received(midi_rt,
rt->receiver_buffer + 2,
rt->receiver_buffer[1]);
}

receiver_buffer is a 64-byte kzalloc() buffer (COMM_RECEIVER_BUFSIZE), so
only 62 bytes follow the two-byte header. receiver_buffer[1] is a u8 the
device chooses, so a device that answers with 0x10 and a length of 0xFF
makes snd_rawmidi_receive() read 255 bytes starting two bytes into a
64-byte object. The bytes past the buffer are handed to userspace
through the rawmidi read path.

urb->actual_length is not consulted either, so a short transfer leaves
both the type byte and the length byte at their previous values and the
handler acts on stale data.

The receiver URB is submitted from usb6fire_comm_init() at probe, so the
read happens on plug with no user action; forwarding to userspace also
needs a MIDI input substream open, since usb6fire_midi_in_received()
only calls snd_rawmidi_receive() when rt->in is set.

KASAN on 7.2.0-rc5 (arm64), single packet from an emulated device:

BUG: KASAN: slab-out-of-bounds in snd_rawmidi_receive
Read of size 255 at addr ffff000009f64682 by task bash/183
__asan_memcpy
snd_rawmidi_receive
usb6fire_midi_in_received [snd_usb_6fire]
usb6fire_comm_receiver_handler [snd_usb_6fire]
Allocated by task 11:
usb6fire_comm_init [snd_usb_6fire]
usb6fire_chip_probe [snd_usb_6fire]
The buggy address is located 2 bytes inside of
allocated 64-byte region [ffff000009f64680, ffff000009f646c0)

Reject the event when the length exceeds the bytes that follow the
header, and require the transfer to have delivered the header plus that
many bytes. The receiver URB is submitted with a 64-byte
transfer_buffer_length, so a genuine device cannot deliver an event
longer than those 62 bytes and nothing valid is dropped.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

Published: 2026-09-11

Score: 6.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A buffer overread can occur in the ALSA 6fire driver when a connected USB 6fire device supplies a MIDI event length larger than the 64‑byte receive buffer. The driver copies the length byte sent, 255 bytes starting two bytes into the 64‑byte buffer. This classic out‑of‑bounds read (CWE‑125) allows kernel memory to be exposed through the raw‑MIDI read path, providing an information‑disclosure vector.

Affected Systems

All systems running a Linux kernel that contains the ALSA 6fire driver before the vendor patch, regardless of distribution or architecture, are affected. The fix was made in the internal patch series referenced in the kernel tree and is expected to be present in subsequent kernel releases.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity, while the EPSS score is under 1%, showing a very low likelihood of widespread exploitation. The flaw is not listed in the CISA KEV catalog. The attacker must supply a USB physically, and the vulnerability triggers automatically on plug‑in before any user action is needed. No publicly known exploit exists, but the kernel memory read could be a stepping‑stone for more advanced attacks if additional privileges can be obtained.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c6d43ba816d1cf1d125bfbfc938f2a28a87facf9`	affected	< c9204bc2ed2010e2469dbe5fce598878a37efd04
`c6d43ba816d1cf1d125bfbfc938f2a28a87facf9`	affected	< 2c590d5e1b1595d5c8fa0b72d2897423ce9985ca
`c6d43ba816d1cf1d125bfbfc938f2a28a87facf9`	affected	< 0c8a3c773823cf12abd39c480aed70e25c384630
`c6d43ba816d1cf1d125bfbfc938f2a28a87facf9`	affected	< 00e84a9ff2d43953ae261995cae94d46f4c307a6
`c6d43ba816d1cf1d125bfbfc938f2a28a87facf9`	affected	< 466e911bbbbb779bb06337e35a286e5ca7af16b3
`c6d43ba816d1cf1d125bfbfc938f2a28a87facf9`	affected	< 2a6f6fba3bd31d2e8c957fefa29156e35e5e75d5
`c6d43ba816d1cf1d125bfbfc938f2a28a87facf9`	affected	< 34816e2cfeabafb8eccf54687186ce25699e8363
`c6d43ba816d1cf1d125bfbfc938f2a28a87facf9`	affected	< a478893b59e36cfe7d77a76b352f2db55502e879

Linux

affected

Version	Status	Constraints
`2.6.39`	affected	—
`0`	unaffected	< 2.6.39
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c6d43ba816d1cf1d125bfbfc938f2a28a87facf9,466e911bbbbb779bb06337e35a286e5ca7af16b3)`	affected	code_commit	—
`[c6d43ba816d1cf1d125bfbfc938f2a28a87facf9,2a6f6fba3bd31d2e8c957fefa29156e35e5e75d5)`	affected	code_commit	—
`[c6d43ba816d1cf1d125bfbfc938f2a28a87facf9,34816e2cfeabafb8eccf54687186ce25699e8363)`	affected	code_commit	—
`[c6d43ba816d1cf1d125bfbfc938f2a28a87facf9,a478893b59e36cfe7d77a76b352f2db55502e879)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.39`	affected	semver	—
`[0,2.6.39)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a Linux kernel update that includes the ALSA 6fire driver fix.
If an immediate kernel upgrade is not feasible, block the device by blacklisting the snddev rule that rejects the USB vendor/product ids for the 6fire device.
Monitor kernel logs for KASAN or other out‑of‑bounds read reports and consider enabling additional memory protection features such as IKASAN or apparmor to detect similar accesses.

Generated by OpenCVE AI on September 21, 2026 at 02:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/00e84a9ff2d43953ae261995cae94d46f4c307a6
https://git.kernel.org/stable/c/0c8a3c773823cf12abd39c480aed70e25c384630
https://git.kernel.org/stable/c/2a6f6fba3bd31d2e8c957fefa29156e35e5e75d5
https://git.kernel.org/stable/c/2c590d5e1b1595d5c8fa0b72d2897423ce9985ca
https://git.kernel.org/stable/c/34816e2cfeabafb8eccf54687186ce25699e8363
https://git.kernel.org/stable/c/466e911bbbbb779bb06337e35a286e5ca7af16b3
https://git.kernel.org/stable/c/a478893b59e36cfe7d77a76b352f2db55502e879
https://git.kernel.org/stable/c/c9204bc2ed2010e2469dbe5fce598878a37efd04
https://nvd.nist.gov/vuln/detail/CVE-2026-80973
https://www.cve.org/CVERecord?id=CVE-2026-80973

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/00e84a9ff2d43953ae261995cae94d46f4c307a6 https://git.kernel.org/stable/c/0c8a3c773823cf12abd39c480aed70e25c384630 https://git.kernel.org/stable/c/2c590d5e1b1595d5c8fa0b72d2897423ce9985ca https://git.kernel.org/stable/c/c9204bc2ed2010e2469dbe5fce598878a37efd04

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80973 https://www.cve.org/CVERecord?id=CVE-2026-80973
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6fire_comm_receiver_handler() forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if (!urb->status) { if (rt->receiver_buffer[0] == 0x10) /* midi in event */ if (midi_rt) midi_rt->in_received(midi_rt, rt->receiver_buffer + 2, rt->receiver_buffer[1]); } receiver_buffer is a 64-byte kzalloc() buffer (COMM_RECEIVER_BUFSIZE), so only 62 bytes follow the two-byte header. receiver_buffer[1] is a u8 the device chooses, so a device that answers with 0x10 and a length of 0xFF makes snd_rawmidi_receive() read 255 bytes starting two bytes into a 64-byte object. The bytes past the buffer are handed to userspace through the rawmidi read path. urb->actual_length is not consulted either, so a short transfer leaves both the type byte and the length byte at their previous values and the handler acts on stale data. The receiver URB is submitted from usb6fire_comm_init() at probe, so the read happens on plug with no user action; forwarding to userspace also needs a MIDI input substream open, since usb6fire_midi_in_received() only calls snd_rawmidi_receive() when rt->in is set. KASAN on 7.2.0-rc5 (arm64), single packet from an emulated device: BUG: KASAN: slab-out-of-bounds in snd_rawmidi_receive Read of size 255 at addr ffff000009f64682 by task bash/183 __asan_memcpy snd_rawmidi_receive usb6fire_midi_in_received [snd_usb_6fire] usb6fire_comm_receiver_handler [snd_usb_6fire] Allocated by task 11: usb6fire_comm_init [snd_usb_6fire] usb6fire_chip_probe [snd_usb_6fire] The buggy address is located 2 bytes inside of allocated 64-byte region [ffff000009f64680, ffff000009f646c0) Reject the event when the length exceeds the bytes that follow the header, and require the transfer to have delivered the header plus that many bytes. The receiver URB is submitted with a 64-byte transfer_buffer_length, so a genuine device cannot deliver an event longer than those 62 bytes and nothing valid is dropped. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Title		ALSA: 6fire: bound the MIDI event length from the device
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2a6f6fba3bd31d2e8c957fefa29156e35e5e75d5 https://git.kernel.org/stable/c/34816e2cfeabafb8eccf54687186ce25699e8363 https://git.kernel.org/stable/c/466e911bbbbb779bb06337e35a286e5ca7af16b3 https://git.kernel.org/stable/c/a478893b59e36cfe7d77a76b352f2db55502e879

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:42:35.751Z

Updated: 2026-09-14T11:59:20.322Z

Reserved: 2026-08-26T14:34:25.810Z

Link: CVE-2026-80973

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:03.490

Modified: 2026-09-14T13:18:52.180

Link: CVE-2026-80973

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:42:35Z

Links: CVE-2026-80973 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T02:30:08Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object