Executive brief
The ALSA aloop audio loopback driver in the Linux kernel does not validate device index values before use, allowing out-of-bounds memory access when a device is bound manually via sysfs. An attacker with local access could trigger a kernel crash or potentially execute code by binding an aloop device with an invalid index, impacting system stability and security.
Technical details
The vulnerability is a missing bounds check in the ALSA aloop driver's probe function (sound/drivers/aloop.c). When the loopback_probe() function processes a platform device, it directly uses the devptr->id field as an array index without validating it is within the valid range [0, SNDRV_CARDS). If a device is bound manually via sysfs with an invalid index (e.g., -1 for "none"), this causes out-of-bounds array access when indexing the index[] and other module parameters. The fix adds a simple validation check: if the device ID is less than 0 or greater than or equal to SNDRV_CARDS, it is clamped to 0 and a warning is issued. The vulnerability requires local access to the sysfs interface and affects the Linux kernel across multiple versions.
Affected products
- Linux Linux kernel multiple versions (affected component: sound/drivers/aloop.c)
Timeline
- 2026-09-11: disclosed
- 2026-08-06: patched: Upstream fix committed by Takashi Iwai