CVE-2026-80973: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-xqvm-46mc-2mf2
Share
Published
Advisory Summary

CVE-2026-80973 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-80973 at a Glance

CVE Identifier CVE-2026-80973
GHSA Identifier GHSA-xqvm-46mc-2mf2
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-80973

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-80973, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6fire_comm_receiver_handler() forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if (!urb->status) { if (rt->receiver_buffer[0] == 0x10) /* midi in event */ if (midi_rt) midi_rt->in_received(midi_rt, rt->receiver_buffer + 2, rt->receiver_buffer[1]); } receiver_buffer is a 64-byte kzalloc() buffer (COMM_RECEIVER_BUFSIZE), so only 62 bytes follow the two-byte header. receiver_buffer[1] is a u8 the device chooses, so a device that answers with 0x10 and a length of 0xFF makes snd_rawmidi_receive() read 255 bytes starting two bytes into a 64-byte object. The bytes past the buffer are handed to userspace through the rawmidi read path. urb->actual_length is not consulted either, so a short transfer leaves both the type byte and the length byte at their previous values and the handler acts on stale data. The receiver URB is submitted from usb6fire_comm_init() at probe, so the read happens on plug with no user action; forwarding to userspace also needs a MIDI input substream open, since usb6fire_midi_in_received() only calls snd_rawmidi_receive() when rt->in is set. KASAN on 7.2.0-rc5 (arm64), single packet from an emulated device: BUG: KASAN: slab-out-of-bounds in snd_rawmidi_receive Read of size 255 at addr ffff000009f64682 by task bash/183 __asan_memcpy snd_rawmidi_receive usb6fire_midi_in_received [snd_usb_6fire] usb6fire_comm_receiver_handler [snd_usb_6fire] Allocated by task 11: usb6fire_comm_init [snd_usb_6fire] usb6fire_chip_probe [snd_usb_6fire] The buggy address is located 2 bytes inside of allocated 64-byte region [ffff000009f64680, ffff000009f646c0) Reject the event when the length exceeds the bytes that follow the header, and require the transfer to have delivered the header plus that many bytes. The receiver URB is submitted with a 64-byte transfer_buffer_length, so a genuine device cannot deliver an event longer than those 62 bytes and nothing valid is dropped. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

References

NVD — CVE-2026-80973 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80973
git.kernel.org/stable/c/00e84a9ff2... WEB
https://git.kernel.org/stable/c/00e84a9ff2d43953ae261995cae94d46f4c307a6
git.kernel.org/stable/c/0c8a3c7738... WEB
https://git.kernel.org/stable/c/0c8a3c773823cf12abd39c480aed70e25c384630
git.kernel.org/stable/c/2a6f6fba3b... WEB
https://git.kernel.org/stable/c/2a6f6fba3bd31d2e8c957fefa29156e35e5e75d5
git.kernel.org/stable/c/2c590d5e1b... WEB
https://git.kernel.org/stable/c/2c590d5e1b1595d5c8fa0b72d2897423ce9985ca
git.kernel.org/stable/c/34816e2cfe... WEB
https://git.kernel.org/stable/c/34816e2cfeabafb8eccf54687186ce25699e8363
git.kernel.org/stable/c/466e911bbb... WEB
https://git.kernel.org/stable/c/466e911bbbbb779bb06337e35a286e5ca7af16b3
git.kernel.org/stable/c/a478893b59... WEB
https://git.kernel.org/stable/c/a478893b59e36cfe7d77a76b352f2db55502e879
git.kernel.org/stable/c/c9204bc2ed... WEB
https://git.kernel.org/stable/c/c9204bc2ed2010e2469dbe5fce598878a37efd04

Frequently Asked Questions

What is CVE-2026-80973?
CVE-2026-80973 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-80973?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-80973?
CVE-2026-80973 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-80973?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xqvm-46mc-2mf2",
  "modified" : "2026-09-14T15:32:21Z",
  "published" : "2026-09-11T21:31:22Z",
  "aliases" : [ "CVE-2026-80973" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: bound the MIDI event length from the device\n\nusb6fire_comm_receiver_handler() forwards a MIDI event using a length\nbyte the device supplies, with no bound and no check that the transfer\ndelivered that many bytes:\n\n\tif (!urb->status) {\n\t\tif (rt->receiver_buffer[0] == 0x10) /* midi in event */\n\t\t\tif (midi_rt)\n\t\t\t\tmidi_rt->in_received(midi_rt,\n\t\t\t\t\t\trt->receiver_buffer + 2,\n\t\t\t\t\t\trt->receiver_buffer[1]);\n\t}\n\nreceiver_buffer is a 64-byte kzalloc() buffer (COMM_RECEIVER_BUFSIZE), so\nonly 62 bytes follow the two-byte header.  receiver_buffer[1] is a u8 the\ndevice chooses, so a device that answers with 0x10 and a length of 0xFF\nmakes snd_rawmidi_receive() read 255 bytes starting two bytes into a\n64-byte object.  The bytes past the buffer are handed to userspace\nthrough the rawmidi read path.\n\nurb->actual_length is not consulted either, so a short transfer leaves\nboth the type byte and the length byte at their previous values and the\nhandler acts on stale data.\n\nThe receiver URB is submitted from usb6fire_comm_init() at probe, so the\nread happens on plug with no user action; forwarding to userspace also\nneeds a MIDI input substream open, since usb6fire_midi_in_received()\nonly calls snd_rawmidi_receive() when rt->in is set.\n\nKASAN on 7.2.0-rc5 (arm64), single packet from an emulated device:\n\n  BUG: KASAN: slab-out-of-bounds in snd_rawmidi_receive\n  Read of size 255 at addr ffff000009f64682 by task bash/183\n   __asan_memcpy\n   snd_rawmidi_receive\n   usb6fire_midi_in_received [snd_usb_6fire]\n   usb6fire_comm_receiver_handler [snd_usb_6fire]\n  Allocated by task 11:\n   usb6fire_comm_init [snd_usb_6fire]\n   usb6fire_chip_probe [snd_usb_6fire]\n  The buggy address is located 2 bytes inside of\n   allocated 64-byte region [ffff000009f64680, ffff000009f646c0)\n\nReject the event when the length exceeds the bytes that follow the\nheader, and require the transfer to have delivered the header plus that\nmany bytes.  The receiver URB is submitted with a 64-byte\ntransfer_buffer_length, so a genuine device cannot deliver an event\nlonger than those 62 bytes and nothing valid is dropped.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-80973"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/00e84a9ff2d43953ae261995cae94d46f4c307a6"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0c8a3c773823cf12abd39c480aed70e25c384630"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2a6f6fba3bd31d2e8c957fefa29156e35e5e75d5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2c590d5e1b1595d5c8fa0b72d2897423ce9985ca"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/34816e2cfeabafb8eccf54687186ce25699e8363"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/466e911bbbbb779bb06337e35a286e5ca7af16b3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a478893b59e36cfe7d77a76b352f2db55502e879"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c9204bc2ed2010e2469dbe5fce598878a37efd04"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-11T20:19:03Z"
  }
}