Executive brief
The Linux kernel's ALSA (Advanced Linux Sound Architecture) FCP driver contains an out-of-bounds write vulnerability in its level meter control handler. An unprivileged user with read access to sound device controls can trigger a write past the bounds of a kernel memory buffer, potentially corrupting adjacent kernel objects and crashing the system or executing arbitrary code.
Technical details
The vulnerability is a heap buffer overflow in the fcp_meter_ctl_get() function within the ALSA FCP driver. The root cause is a mismatch between two bounds checks: fcp_ioctl_set_meter_map() allows a meter map size up to 255, but stores this as elem->channels, which is then used in fcp_meter_ctl_get() to write into a snd_ctl_elem_value structure whose integer array is only 128 elements long (512 bytes on LP64). The function writes one 64-bit word per channel with no validation, allowing writes up to 2112 bytes when map_size is 255, overflowing the 1224-byte allocation by 888 bytes. The exploit requires CAP_SYS_RAWIO to set up the oversized map, but any process reading sound controls can trigger the overflow. A fix bounds the map size to 128 and adds additional bounds checking in the store loop.
Affected products
- Linux Linux kernel 7.2.0-rc5 and earlier
Timeline
- 2026-08-22: disclosed
- other: KASAN triggered on 7.2.0-rc5 (arm64)