Executive brief
The ALSA mts64 audio driver in the Linux kernel failed to validate card index numbers when devices are bound via sysfs. Attackers could supply negative or out-of-range index values that lead to out-of-bounds memory access, potentially allowing local privilege escalation or denial of service on affected systems.
Technical details
The vulnerability is an out-of-bounds access (OOB) in the ALSA mts64 driver (sound/drivers/mts64.c) during device probe. Although the driver checked that the index value did not exceed SNDRV_CARDS, it did not validate against negative values (dev < 0), which can be set via sysfs binding with "none" or similar. This allows negative indices to access the index[] array out of bounds. The vulnerability requires local access and ability to manipulate sysfs device binding. The fix adds a sanity check that rejects negative indices and clamps them to 0 with a warning.
Affected products
- Linux Linux kernel 2.6.11 through 7.2 (patched versions available)
Timeline
- 2026-09-11: disclosed: CVE-2026-80968 published
- 2026-08-06: patched: Fix committed by Takashi Iwai