Executive brief
The ALSA mpu401 driver, which manages MIDI port hardware on Linux systems, fails to validate the card device index at probe time. When a device is manually bound via sysfs, an invalid index value (such as -1) can bypass validation, leading to out-of-bounds memory access that could cause a kernel crash or enable local privilege escalation.
Technical details
The vulnerability is an out-of-bounds array access caused by missing input validation in the mpu401 probe function. The driver blindly trusts the devptr->id value without checking whether it falls within the valid range [0, SNDRV_CARDS). When a device is manually bound through the sysfs interface, the id can be set to -1 ("none"), causing OOB access to the index[] array and other driver parameters. The fix adds a sanity check that validates the card index and corrects invalid values to 0. The vulnerability requires local system access to manually bind devices via sysfs; it is not remotely exploitable.
Affected products
- Linux Linux kernel multiple versions through at least 6.18 and earlier
Timeline
- 2026-09-11: disclosed: Published on NVD
- 2026-08-06: patched: Upstream fix by Takashi Iwai