Junglewise Threat Intelligence

CVE-2026-80972: Linux kernel ALSA aloop out-of-bounds access via invalid card index

CVE-2026-80972 · Severity: info · Published 2026-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The ALSA aloop audio loopback driver in the Linux kernel does not validate device index values before use, allowing out-of-bounds memory access when a device is bound manually via sysfs. An attacker with local access could trigger a kernel crash or potentially execute code by binding an aloop device with an invalid index, impacting system stability and security.

Technical details

The vulnerability is a missing bounds check in the ALSA aloop driver's probe function (sound/drivers/aloop.c). When the loopback_probe() function processes a platform device, it directly uses the devptr->id field as an array index without validating it is within the valid range [0, SNDRV_CARDS). If a device is bound manually via sysfs with an invalid index (e.g., -1 for "none"), this causes out-of-bounds array access when indexing the index[] and other module parameters. The fix adds a simple validation check: if the device ID is less than 0 or greater than or equal to SNDRV_CARDS, it is clamped to 0 and a warning is issued. The vulnerability requires local access to the sysfs interface and affects the Linux kernel across multiple versions.

Affected products

  • Linux Linux kernel multiple versions (affected component: sound/drivers/aloop.c)

Timeline

  • 2026-09-11: disclosed
  • 2026-08-06: patched: Upstream fix committed by Takashi Iwai

References

Related threats