CVE-2023-54022: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54022 is a memory leak vulnerability in the Linux kernel's ALSA USB audio subsystem, specifically in the MIDI 2.0 / UMP (Universal MIDI Packet) device handling code. The flaw exists in the alloc_midi_urbs() and snd_usb_midi_v2_open() functions, where error paths fail to properly release allocated memory. It was published on December 24, 2025, and affects Linux kernel versions starting from the introduction of MIDI 2.0 UMP support (around kernel 6.5), with fixes available in stable commits targeting the 6.5.x and 6.6 series. No CVSS score has been formally assigned by NVD at this time; Feedly estimates the severity as Medium with an EPSS score of 0.00018 (Feedly, EUVD).

The root cause is improper memory management (CWE class: memory leak) in the Linux kernel's sound/usb/midi2.c component. In alloc_midi_urbs(), when an allocation or initialization error occurs, the cleanup function free_midi_urbs() is called, but it only iterates over ep->num_urbs entries — which has not yet been updated at the point of failure — causing allocated URB entries to be skipped and leaked. Additionally, snd_usb_midi_v2_open() was missing a call to free_midi_urbs() entirely on its error path, meaning memory would only be reclaimed later at device reopen, close, or disconnection rather than immediately. The fix changes the loop bound in free_midi_urbs() to NUM_URBS and adds the missing cleanup call in snd_usb_midi_v2_open() (kernel.org patch 1, kernel.org patch 2).

Exploitation of this vulnerability results in kernel memory leaks when a MIDI 2.0 / UMP USB audio device encounters errors during URB allocation or device open operations. Over time or under repeated error conditions, this could degrade system stability and potentially exhaust kernel memory resources, leading to degraded performance or denial of service. There is no evidence of confidentiality or integrity impact; the primary risk is availability on systems that frequently attach/detach MIDI 2.0 USB audio devices under error conditions (Feedly).

Apply the upstream Linux kernel patches that fix the memory leak: commit b1757fa30ef14f254f4719bf6f7d54a4c8207216 (targeting the 6.6 stable branch) and commit f819b343aa95d24d5f7d6e06660c7f62591abc5f (targeting the 6.5.x stable branch). Distribution-specific kernel updates incorporating these fixes have been released for SUSE (SUSE-2026-0281-1 and SUSE-2026-20876-1) (Linux Security SUSE advisory 1, Linux Security SUSE advisory 2). As a workaround, systems that do not use MIDI 2.0 / UMP USB audio devices can avoid exposure by not loading the snd-usb-audio module or by restricting USB device attachment.