CVE-2026-80812 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: dummy: Check card index validity at probe
snd_dummy_probe() blindly trusts that the given devptr->id value is within the proper card index range. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters.
Add a sanity check for the card index and warn/correct it if it's a value out of the range.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel’s Advanced Linux Sound Architecture (ALSA) subsystem contains a critical input validation flaw within the dummy sound driver, specifically in the snd_dummy_probe function. This vulnerability arises from an insufficient verification of user-supplied or externally bound device identifiers before they are used as array indices. The snd_dummy_probe routine is responsible for initializing and registering a new ALSA card instance when a corresponding device node is detected or manually associated with the driver. Under normal operational conditions, where devices are created automatically by the kernel during module initialization, the identifier values provided to this function fall within expected bounds. However, the code fails to perform rigorous boundary checks on the devptr->id value before utilizing it as an index into internal data structures such as the card_index array and other related parameter sets.
This lack of validation creates a significant risk when devices are bound manually through the sysfs interface. Sysfs allows system administrators or userspace applications to explicitly bind drivers to specific device nodes, bypassing some automatic kernel heuristics. In this scenario, an attacker with local access who can manipulate sysfs bindings may supply a devptr->id value of -1, which represents "none" in certain ALSA contexts, or any other integer outside the valid range for card indices. Because the probe function blindly trusts this input without verifying that it corresponds to a legitimate slot within the allocated arrays, the kernel proceeds to access memory at an invalid offset. This results in an out-of-bounds read or write operation, depending on whether the code attempts to retrieve existing data or store new configuration parameters into the indexed location.
The operational impact of this vulnerability is severe, as it constitutes a classic buffer over-read or over-write condition that can lead to kernel memory corruption. An attacker exploiting this flaw could potentially crash the system by triggering an invalid memory access exception, leading to a denial-of-service state where the entire operating system becomes unresponsive and requires a reboot. More critically, if the out-of-bounds write targets specific control structures within the kernel heap or stack, it may allow for arbitrary code execution with root privileges. Since ALSA operates at a low level in the kernel space, successful exploitation grants full control over the host machine, compromising confidentiality, integrity, and availability of all data and services running on the system.
This vulnerability is categorized under CWE-125, which describes out-of-bounds read vulnerabilities, or potentially CWE-787 if it involves writes to memory outside the intended buffer boundaries. From a tactical perspective, this aligns with MITRE ATT&CK technique T1059, specifically command and scripting interpreter abuse via system interfaces like sysfs, allowing for privilege escalation through local exploitation of kernel flaws. The root cause is identified as CWE-20, improper input validation, where the software does not sufficiently verify that incoming data conforms to expected formats or ranges before processing.
To mitigate this risk, developers have implemented a sanity check within the snd_dummy_probe function to validate the card index value prior to its use in array indexing operations. The patch ensures that if the provided identifier is out of range, such as being negative like -1, the driver will either issue a warning and correct the value or abort the probe process entirely rather than proceeding with invalid memory access. System administrators should apply this kernel update immediately to close the gap between manual sysfs bindings and internal array bounds. Additionally, restricting write permissions on relevant sysfs entries for unprivileged users can provide an additional layer of defense against unauthorized device binding attempts that could trigger this vulnerability in environments where patching is delayed.