CVE-2026-80964: ALSA: virmidi: Check card index validity at probe
In the Linux kernel, the following vulnerability has been resolved:
ALSA: virmidi: Check card index validity at probe
virmidi driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters.
Add a sanity check for the card index and warn/correct it if it's a value out of the range.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply a kernel patch that adds a sanity check for virmidi card index validity at module probe time (warn/correct when the sysfs-bound card index is out of range, e.g., -1 meaning "none"), preventing OOB access to index[] and other parameters.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems are exposed when the ALSA virmidi driver is manually bound through the sysfs interface with an invalid card index. Devices created by the driver during its normal module probe path are described as using a valid index.
What does an attacker or local user need to do to trigger it?
They need to manually bind a virmidi device through sysfs such that the device's card ID is invalid, including -1, which represents "none." This can cause out-of-bounds access to the index array and other parameters.
What mitigation is available if the fix cannot be applied immediately?
Avoid manually binding virmidi devices through the sysfs interface with an unset or invalid card index. Ensure any manually bound device has a card index within the proper valid range.
How does the resolved code address the problem?
The fix validates the card index during probe and warns and corrects values that are outside the allowed range.