Executive brief
The Linux kernel's ALSA virmidi driver is a virtual MIDI sound card interface used in audio production and music software. A flaw in the driver blindly trusts user-provided card index values without validation, potentially allowing array index out-of-bounds access that could corrupt kernel memory or cause system crashes when a device is manually bound via sysfs.
Technical details
The vulnerability is an out-of-bounds (OOB) array access in the virmidi driver's probe function (sound/drivers/virmidi.c). The root cause is that the driver does not validate the devptr->id value before using it as an index into the index[] and other parameter arrays. While the driver typically creates devices safely during module load, manual device binding via the sysfs interface can supply invalid index values (including -1 for "none"), leading to OOB read/write access. The fix adds a sanity check: if the device ID is outside the valid range [0, SNDRV_CARDS), it logs a warning and resets the value to 0. The patch was merged upstream and backported to stable kernel branches.
Affected products
- Linux Linux kernel all versions prior to fix (2026-08-06)
Timeline
- 2026-09-11: disclosed: CVE published
- 2026-08-06: patched: Fix merged upstream by Takashi Iwai
- 2026-09-14: other: Backported to stable kernel branches