In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out… (CVE-2026-98770)

The Linux kernel's usb gadget midi2 driver had a vulnerability due to incorrect sizing of the jack in/out descriptor arrays in struct f_midi2_usb_config. The arrays were sized as MAX_CABLES, but since entries are added for both inputs and outputs in each loop iteration, the actual required size is twice that. This inconsistency could cause out-of-bounds memory access when many jacks are set up via configfs, despite the loop count being limited to MAX_CABLES. The fix involved resizing the jack_ins and jack_outs arrays to MAX_CABLES * 2 to prevent potential OOB conditions.

The vulnerability could lead to out-of-bounds memory access in the Linux kernel USB gadget MIDI2 driver when configuring a large number of jacks, potentially causing memory corruption or instability. No specific exploitation details or active exploits are known. The impact is limited to configurations involving many MIDI jack descriptors via configfs.

A fix is available that corrects the jack descriptor array sizes to twice MAX_CABLES. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation.