Last updated 7 July 2026

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces

The Scarlett2 mixer quirk in USB-audio driver may hit a NULL dereference when a malformed USB descriptor is passed, since it assumes the presence of an endpoint in the parsed interface in scarlett2findfcinterface(), as reported by fuzzer.

For avoiding the NULL dereference, just add the sanity check of bNumEndpoints and skip the invalid interface.

alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplgdecodecontrolmixer1() function reads the numchannels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SNDTPLGMAXCHAN). A crafted topology file with an excessive numchannels value can cause out-of-bounds heap writes, leading to a crash.

In the Linux kernel, the following vulnerability has been resolved:

ALSA: rawmidi - fix the uninitalized userpversion

The userpversion was uninitialized for the user space file structure in the open function, because the file private structure use kmalloc for the allocation.

The kernel ALSA sequencer code clears the file structure, so no additional fixes are required.

BugLink: https://github.com/alsa-project/alsa-lib/issues/178

ALSA sequencer core initializes the event pool on demand by invoking sndseqpoolinit() when the first write happens and the pool is empty. A user can reset the pool size manually via ioctl concurrently, and this may lead to UAF or out-of-bound access.

References:

http://mailman.alsa-project.org/pipermail/alsa-devel/2018-February/132026.html

https://marc.info/?l=alsa-devel&m=151859118611846&w=2

An upstream fix:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d15d662e89fc667b90cd294b0eb45694e33144da

A use-after-free vulnerability was found at creating and deleting a port via an ioctl on /dev/snd/seq. The sndseqcreateport() function creates a port object and returns its pointer, but it doesn't take a refcount and can be deleted immediately by another thread.

Meanwhile, sndseqioctlcreateport() still calls the function sndseqsystemclientevportstart() with the created port object that is being deleted, which triggers use-after-free. An attacker can race this use for memory corruption or possibly privilege escalation.

At the time of writing, the permissions on the device file required a local console user to be issue the ioctl to allow for the exploit to work correctly. Remote users accessing the system via a shell were not granted permissions to issue an IOCTL that can trigger this condition.

References:

http://seclists.org/oss-sec/2017/q4/58

http://mailman.alsa-project.org/pipermail/alsa-devel/2017-October/126292.html

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=71105998845fb012937332fe2e806d443c09e026

alsa-utils-1.0.19 and later allows local users to overwrite arbitrary files via a symlink attack via the 1), /usr/bin/alsa-info and 2, /usr/bin/alsa-info.sh scripts.