Executive brief
The Linux kernel's ALSA audio driver for the Portman2x4 MIDI interface did not properly validate card index values during device probing. When the driver receives an invalid (negative) index value—commonly assigned when devices are bound via sysfs—it could read or write beyond the bounds of internal array structures, potentially causing system instability or information disclosure.
Technical details
The vulnerability is an out-of-bounds (OOB) array access flaw in the ALSA portman2x4 driver's probe function. The root cause is insufficient validation of the card device index (devptr->id); although the driver checked for values exceeding the maximum, it failed to reject negative indices. When a negative index is passed (e.g., when binding via sysfs with "none"), the driver would use it to index into the index[] and other parameter arrays without bounds checking, leading to OOB access. The fix adds a sanity check that rejects negative indices, logs a warning, and defaults the index to 0. This is a local vulnerability requiring platform device binding capability.
Affected products
- Linux Linux kernel 2.6.11 through 7.x (all versions with ALSA portman2x4 driver)
Timeline
- 2026-09-11: disclosed
- 2026-08-06: patched: Fix authored by Takashi Iwai