The Linux kernel ALSA 6fire USB MIDI driver had a vulnerability where the usb6fire_comm_receiver_handler() function forwarded MIDI events using a length byte provided by the device without validating that the length was within the allocated 64-byte buffer. This allowed a device to specify a length up to 255 bytes, causing snd_rawmidi_receive() to read beyond the buffer boundary and potentially expose out-of-bounds memory to userspace. Additionally, the handler did not check urb->actual_length, so short transfers could cause stale data to be processed. The fix bounds the MIDI event length to the buffer size and requires the transfer to deliver the expected number of bytes, preventing out-of-bounds reads.

This vulnerability could allow a malicious or faulty USB MIDI device to cause out-of-bounds reads in kernel memory, potentially leading to information disclosure or kernel memory corruption. The flaw affects the ALSA 6fire USB MIDI driver and could be triggered immediately upon device connection if a MIDI input substream is open. No known exploits in the wild have been reported.

A fix has been implemented that bounds the MIDI event length and validates the transfer length to prevent out-of-bounds reads. Users should apply the official Linux kernel update containing this fix. No additional mitigation is required as the patch addresses the root cause.