CVE-2026-80812: ALSA: dummy: Check card index validity at probe
In the Linux kernel, the following vulnerability has been resolved:
ALSA: dummy: Check card index validity at probe
snddummyprobe() blindly trusts that the given devptr->id value is within the proper card index range. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters.
Add a sanity check for the card index and warn/correct it if it's a value out of the range.
Event History
Frequently Asked Questions
Are normally created dummy ALSA devices affected?
The driver-created devices initialized during module probe are described as safe. The issue arises when a device is manually bound through the sysfs interface.
What is required to trigger the out-of-bounds access?
A manually sysfs-bound device must supply an invalid card index, such as -1, which represents “none.” The probe path previously trusted this value and could access index-related arrays out of bounds.
What can be done before applying the resolved kernel change?
Avoid manually binding ALSA dummy devices through sysfs with an invalid card index. Ensure any manually supplied card index is within the valid card-index range.