CVE-2026-80972: ALSA: aloop: Check card index validity at probe
In the Linux kernel, the following vulnerability has been resolved:
ALSA: aloop: Check card index validity at probe
aloop driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters.
Add a sanity check for the card index and warn/correct it if it's a value out of the range.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Manually validate the aloop device card index exposed/used via the sysfs interface is within the proper card index range before loading/using the aloop driver, to avoid out-of-bounds access caused by an invalid devptr->id value (e.g., -1/"none").
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the ALSA aloop driver are exposed when a device is manually bound through the sysfs interface with an invalid card index. Devices created by the driver itself during module probe are described as OK.
What access or condition is needed to trigger the problem?
The problematic condition requires manually binding an aloop device via sysfs while its devptr->id is outside the valid card-index range, such as -1, which represents "none." This can cause out-of-bounds access to index[] and related parameters.
What can be done before applying the fix?
Avoid manually binding aloop devices through sysfs with a missing or invalid card index. Ensure the card index used for such binding is within the valid range.