Executive brief
The ALSA (Advanced Linux Sound Architecture) dummy audio driver in the Linux kernel did not properly validate card index values when devices were manually bound via sysfs, allowing an out-of-bounds array access. An attacker with local access to sysfs could trigger this flaw to read or corrupt kernel memory, potentially leading to privilege escalation or denial of service.
Technical details
The vulnerability exists in the snd_dummy_probe() function in sound/drivers/dummy.c, which blindly trusts the devptr->id value without validating it falls within the valid card index range (0 to SNDRV_CARDS-1). When a device is manually bound via sysfs interface, this ID can be -1 (representing "none"), causing out-of-bounds access to the index[] and other parameter arrays. The attack requires local access and direct interaction with the sysfs interface. A patch was committed adding a sanity check that validates the card index and defaults it to 0 if out of range. The fix has been backported to stable kernel trees.
Affected products
- Linux Linux kernel All versions with ALSA dummy driver (patched upstream and in stable branches)
Timeline
- 2026-09-04: disclosed: Published on NVD
- 2026-08-06: patched: Upstream fix by Takashi Iwai
- 2026-08-27: patched: Backported to stable kernels via Greg Kroah-Hartman