In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Bound MIDI endpoint descriptor scans snd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint descriptor size before using baAssocJackID[], but the descriptor walker can still return a class-specific endpoint descriptor whose bLength exceeds the remaining bytes in the endpoint-extra scan. That leaves later flexible-array reads bounded by bLength, but not by the remaining bytes in the endpoint-extra scan. Stop walking when bLength is zero or extends past the remaining endpoint-extra scan.

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) USB audio driver. The driver's handling of MIDI (Musical Instrument Digital Interface) endpoint descriptors did not properly bound scans, allowing it to read beyond the intended memory buffer. This out-of-bounds read could potentially lead to information disclosure or cause system instability.

Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Fix deferred kernel Red Hat Enterprise Linux 8 Fix deferred kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-52963 https://nvd.nist.gov/vuln/detail/CVE-2026-52963 https://lore.kernel.org/linux-cve-announce/2026062437-CVE-2026-52963-2264@gregkh/T