CVE-2026-80968ALSA: mts64: Check card index validity at probe
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ALSA: mts64: Check card index validity at probe Although mts64 driver has a check of the given devptr->id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via sysfs. This may lead to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 68ab801e32bbe2caac8b8c6e6e94f41fe7d687ad before 1566ca99fc0e892b9164ad893d268b00064fff54; 68ab801e32bbe2caac8b8c6e6e94f41fe7d687ad builds before 5d986d8c9e616636032636d99133f2535f94300d; from 68ab801e32bbe2caac8b8c6e6e94f41fe7d687ad before 5168a6241e953ecadb0ec05609649f6a7367fef8; 68ab801e32bbe2caac8b8c6e6e94f41fe7d687ad builds before 9cd7c59a106e7267d0cbcf68670594584d8689d0; 68ab801e32bbe2caac8b8c6e6e94f41fe7d687ad builds before 036e7aa793375ab16ea0f64b8de6673220416cc1; from 68ab801e32bbe2caac8b8c6e6e94f41fe7d687ad before a4e774eeb61aec64da5b03d3becffde26f7fe4de; from 68ab801e32bbe2caac8b8c6e6e94f41fe7d687ad before cf3af453a48c8d905512dfc44a5a59439b70f4f0; from 68ab801e32bbe2caac8b8c6e6e94f41fe7d687ad before d18a260720f86a5f8b5fcfefc4ba2e9dd01c10f8 | CNA record |
References
- https://git.kernel.org/stable/c/1566ca99fc0e892b9164ad893d268b00064fff54
- https://git.kernel.org/stable/c/5d986d8c9e616636032636d99133f2535f94300d
- https://git.kernel.org/stable/c/5168a6241e953ecadb0ec05609649f6a7367fef8
- https://git.kernel.org/stable/c/9cd7c59a106e7267d0cbcf68670594584d8689d0
- https://git.kernel.org/stable/c/036e7aa793375ab16ea0f64b8de6673220416cc1
- https://git.kernel.org/stable/c/a4e774eeb61aec64da5b03d3becffde26f7fe4de
- https://git.kernel.org/stable/c/cf3af453a48c8d905512dfc44a5a59439b70f4f0
- https://git.kernel.org/stable/c/d18a260720f86a5f8b5fcfefc4ba2e9dd01c10f8
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.