CVE-2026-80965: ALSA: serial-u16550: Check card index validity at probe
In the Linux kernel, the following vulnerability has been resolved:
ALSA: serial-u16550: Check card index validity at probe
serial-u16550 driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters.
Add a sanity check for the card index and warn/correct it if it's a value out of the range.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using the Linux ALSA serial-u16550 driver are exposed when a device can be manually bound through the sysfs interface. Devices created by the driver itself during module probe are described as unaffected by the invalid-index condition.
What is required to trigger the out-of-bounds access?
An attacker or local user would need to manually bind a device via sysfs such that devptr->id is -1, representing "none," or otherwise outside the valid card-index range. The driver previously trusted this value during probe and used it to access index-related parameters.
What mitigation is available if an update cannot be applied immediately?
Avoid manually binding serial-u16550 devices through sysfs with an unset or invalid card index. Use the driver's normal module-probe device creation path, which is stated to provide a valid index.