Executive brief
The Linux kernel's ALSA (Advanced Linux Sound Architecture) control layer includes a LED state tracking feature that assumed all audio controls were readable. An attacker or local user could create a write-only audio control element without a read callback, triggering a null pointer dereference that crashes the kernel. This vulnerability allows local denial of service on systems with audio support enabled.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the ALSA control LED layer (sound/core/control_led.c). The kcontrol LED state layer assumes all registered kcontrol elements have both info and get callbacks for reading state, but a user can create a write-only element without these callbacks. When snd_ctl_led_notify() processes such an element, it dereferences null pointers, causing a kernel panic. The fix adds a sanity check verifying that both kctl->info and kctl->get callbacks exist before assigning the control to the LED layer. Attack vector is local (requires ability to create audio controls); no remote exploitation or privilege escalation is possible.
Affected products
- Linux Linux kernel multiple versions from 2.6.11 through 7.2 (see commit history)
Timeline
- 2026-08-27: other: Patch authored by Takashi Iwai
- 2026-09-14: patched: Patch merged to stable kernel trees
- 2026-09-17: disclosed: CVE-2026-90060 published