The kernel’s USB gadget midi2 driver incorrectly sizes the jack descriptor arrays—allocating only MAX_CABLES elements instead of the required twice value. When a configuration creates many jack inputs and outputs via configfs, the array indices can exceed the allocated space, causing a buffer overflow. This overflow may corrupt kernel memory, potentially leading to a denial‑of‑service or other unintended system instability.

The flaw resides in the Linux kernel’s vendor‑agnostic "Linux:Linux" code, specifically the usb gadget midi2 component. Any kernel build that incorporates the midi2 gadget driver before the fix is potentially impacted, regardless of distribution or version, until the corrected array sizes (twice MAX_CABLES) are applied.

The vulnerability is not catalogued in the CISA KEV list and its EPSS score is < 1%. The CVSS score is 4.4, indicating moderate risk. The attack vector requires the ability to write to the configfs interface of the USB gadget driver, typically available to privileged local users or users controlling the device firmware. Because the issue occurs in kernel space, successful exploitation could destabilize the system. The overall risk is therefore moderate to high for environments that expose the USB gadget midi2 driver to untrusted configuration input.