CVE-2026-64490ALSA: virtio: Validate control metadata from the device
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used directly to index g_v2a_type_map[] in virtsnd_kctl_info(), and to size loops and memcpy() operations in virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size virtio_snd_ctl_value and snd_ctl_elem_value arrays. A buggy or malicious device can therefore trigger out-of-bounds access by advertising an invalid control type or an oversized value count. Validate control type and count once in virtsnd_kctl_parse_cfg(), before querying enumerated items or exposing the control to ALSA.
- CVSS
- 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d6568e3de42dd971a1356f7ba581e6600d53f0a0 before 3243563f99ef5d3949b934bd6390a5679405d0e1; from d6568e3de42dd971a1356f7ba581e6600d53f0a0 before 5da9742de22db0dbaa8d414214ab5e1bedde00f9; from d6568e3de42dd971a1356f7ba581e6600d53f0a0 before 21584672fd699abe1768241d6c501b2de6139b6a; from d6568e3de42dd971a1356f7ba581e6600d53f0a0 before c77a6cbb36ff8cbc1f084d94f8dcda5250935271 | CNA record |
References
- https://git.kernel.org/stable/c/3243563f99ef5d3949b934bd6390a5679405d0e1
- https://git.kernel.org/stable/c/5da9742de22db0dbaa8d414214ab5e1bedde00f9
- https://git.kernel.org/stable/c/21584672fd699abe1768241d6c501b2de6139b6a
- https://git.kernel.org/stable/c/c77a6cbb36ff8cbc1f084d94f8dcda5250935271
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.