LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21835: usb: gadget: f_midi: fix MIDI Streaming descriptor lengths

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: fix MIDI Streaming descriptor lengths While the MIDI jacks are configured correctly, and the MIDIStreaming endpoint descriptors are filled with the correct information, bNumEmbMIDIJack and bLength are set incorrectly in these descriptors. This does not matter when the numbers of in and out ports are equal, but when they differ the host will receive broken descriptors with uninitialized stack memory leaking into the descriptor for whichever value is smaller. The precise meaning of "in" and "out" in the port counts is not clearly defined and can be confusing. But elsewhere the driver consistently uses this to match the USB meaning of IN and OUT viewed from the host, so that "in" ports send data to the host and "out" ports receive data from it.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-21835 is a Linux kernel USB MIDI gadget issue. When a device exposes different numbers of MIDI input and output ports, it can send malformed USB descriptors that include uninitialized kernel stack memory. This is mainly relevant to Linux-based devices acting as USB MIDI peripherals, not ordinary systems that only connect to USB devices.

Executive priority

Treat as a targeted exposure issue, not a broad enterprise emergency. Prioritize embedded, appliance, lab, audio, and industrial devices that present themselves over USB as MIDI gadgets. Patch through normal kernel or vendor maintenance unless those devices handle sensitive data or are exposed to untrusted USB hosts.

Technical view

The flaw is in the Linux kernel USB gadget f_midi function. Incorrect bNumEmbMIDIJack and bLength values in MIDIStreaming endpoint descriptors can leak uninitialized stack memory when configured IN and OUT port counts differ. Upstream stable kernel commits correct the descriptor lengths. The CVE record does not provide CVSS, CWE, or confirmed exploit activity.

Likely exposure

Exposure is likely limited to Linux systems or embedded products using USB gadget mode with f_midi enabled, especially configurations with unequal MIDI IN and OUT port counts. General-purpose Linux hosts that do not present themselves as USB MIDI gadgets are less likely to be exposed.

Exploitation context

The provided sources do not report active exploitation, and the CVE is not marked in KEV. Exploitation appears to require interaction with a Linux device operating as a USB MIDI gadget and receiving its descriptors as a USB host.

Researcher notes

The core impact is information disclosure from uninitialized stack memory in USB descriptors. The sources do not establish privilege escalation, remote network attackability, or public exploitation. Affected-version data is kernel-centric and should be reconciled with distribution backports and vendor product advisories.

Mitigation direction

  • Update to a kernel containing the referenced upstream stable fixes.
  • Apply applicable Debian LTS kernel updates if using affected Debian releases.
  • Check vendor advisories for embedded or industrial products using Linux USB gadget features.
  • Disable or avoid f_midi gadget configurations if not required.

Validation and detection

  • Inventory Linux devices that operate in USB gadget mode.
  • Identify whether the f_midi gadget function is enabled or available.
  • Review MIDI gadget configurations for unequal IN and OUT port counts.
  • Compare kernel packages against vendor or upstream fixed versions.
  • Check Debian and device-vendor advisories for product-specific status.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21835 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
12Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc8933c3f79568263c90a46f06cf80419e6c63c97, c8933c3f79568263c90a46f06cf80419e6c63c97, c8933c3f79568263c90a46f06cf80419e6c63c97, c8933c3f79568263c90a46f06cf80419e6c63c97, c8933c3f79568263c90a46f06cf80419e6c63c97, c8933c3f79568263c90a46f06cf80419e6c63c97, c8933c3f79568263c90a46f06cf80419e6c63c97, c8933c3f79568263c90a46f06cf80419e6c63c97unaffected
LinuxLinux3.2, 0, 5.4.291, 5.10.235, 5.15.179, 6.1.129, 6.6.79, 6.12.16, 6.13.4, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.