CVE-2026-64490
Received Received - Intake

Out-of-Bounds Access in Linux Kernel ALSA virtio-snd Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used directly to index g_v2a_type_map[] in virtsnd_kctl_info(), and to size loops and memcpy() operations in virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size virtio_snd_ctl_value and snd_ctl_elem_value arrays. A buggy or malicious device can therefore trigger out-of-bounds access by advertising an invalid control type or an oversized value count. Validate control type and count once in virtsnd_kctl_parse_cfg(), before querying enumerated items or exposing the control to ALSA.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64490
EUVD
EUVD-2026-48834

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of control metadata from a virtio-snd device. The device provides control type and value count which are used to index arrays and perform memory operations without proper bounds checking. A malicious device could exploit this to trigger out-of-bounds memory access.

Detection Guidance

This vulnerability affects the Linux kernel's ALSA virtio sound driver. Detection requires checking kernel logs for virtio-snd related errors or kernel crashes. Monitor for out-of-bounds access warnings or system instability when using virtio-snd devices. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow a malicious or buggy virtio-snd device to cause memory corruption in the Linux kernel. This might lead to system crashes, privilege escalation, or arbitrary code execution, depending on the kernel's memory layout and protections.

Mitigation Strategies

Update the Linux kernel to the latest patched version. Disable virtio-snd if not needed. Restrict access to virtual machines that may use virtio-snd devices. Monitor vendor advisories for kernel updates addressing this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64490. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart