Junglewise Threat Intelligence

CVE-2026-80969: Linux kernel ALSA mpu401 out-of-bounds array access

CVE-2026-80969 · Severity: info · Published 2026-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The ALSA mpu401 driver, which manages MIDI port hardware on Linux systems, fails to validate the card device index at probe time. When a device is manually bound via sysfs, an invalid index value (such as -1) can bypass validation, leading to out-of-bounds memory access that could cause a kernel crash or enable local privilege escalation.

Technical details

The vulnerability is an out-of-bounds array access caused by missing input validation in the mpu401 probe function. The driver blindly trusts the devptr->id value without checking whether it falls within the valid range [0, SNDRV_CARDS). When a device is manually bound through the sysfs interface, the id can be set to -1 ("none"), causing OOB access to the index[] array and other driver parameters. The fix adds a sanity check that validates the card index and corrects invalid values to 0. The vulnerability requires local system access to manually bind devices via sysfs; it is not remotely exploitable.

Affected products

  • Linux Linux kernel multiple versions through at least 6.18 and earlier

Timeline

  • 2026-09-11: disclosed: Published on NVD
  • 2026-08-06: patched: Upstream fix by Takashi Iwai

References

Related threats