{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "4434ade8c9334a3ab975d8993de456f06841899e"
            },
            {
              "fixed": "29a4c29943631301e85f5e9d10f25741bd78e7ba"
            },
            {
              "fixed": "9b22a5c8310b0d55d04f5f0159b913a2fb8b444f"
            },
            {
              "fixed": "b5305a0d0bb8e90a6fc9f88270d5f6c9b8c40081"
            },
            {
              "fixed": "2b7a0f330dd90dd1a7657cec0db019ee1efa4372"
            },
            {
              "fixed": "0970274613fb463d376211450cab066d34ebfe6a"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.35"
            },
            {
              "fixed": "6.6.151"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.103"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.44"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.1.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74499.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()\n\nsnd_usbmidi_akai_output() computes its fill-loop bound\n\n\tbuf_end = ep-\u003emax_transfer - MAX_AKAI_SYSEX_LEN - 1;\n\nas a signed int, so a small device-advertised bulk-OUT max_transfer\nmakes buf_end negative.  The loop guard then compares the u32\nurb-\u003etransfer_buffer_length against that negative int: the usual\narithmetic conversion turns buf_end into a large unsigned value, so the\nguard stays true and each iteration keeps appending SysEx framing and\npayload bytes past the end of the URB transfer buffer, which is only\nmax_transfer bytes long.\n\nA USB device that advertises a tiny bulk-OUT endpoint can therefore\ntrigger an attacker-length- and content-controlled heap out-of-bounds\nwrite when a process writes to the created /dev/snd/midiC*D* node.\n\nReturn early when there is no room for even one SysEx, so the loop is\nnever entered with a bound that would wrap.  The loop is the last\nstatement of the function, so bailing out is equivalent to it not\nrunning.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e",
  "id": "CVE-2026-74499",
  "modified": "2026-08-17T03:36:08.510411251Z",
  "published": "2026-08-15T12:27:25.728Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0970274613fb463d376211450cab066d34ebfe6a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/29a4c29943631301e85f5e9d10f25741bd78e7ba"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2b7a0f330dd90dd1a7657cec0db019ee1efa4372"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9b22a5c8310b0d55d04f5f0159b913a2fb8b444f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b5305a0d0bb8e90a6fc9f88270d5f6c9b8c40081"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74499.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74499"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()"
}