CVE-2026-80812
Received Received - Intake

Out-of-Bounds Access in Linux Kernel ALSA Dummy Sound Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: dummy: Check card index validity at probe snd_dummy_probe() blindly trusts that the given devptr->id value is within the proper card index range. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80812
EUVD
EUVD-2026-71247

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where the snd_dummy_probe function does not validate the card index value provided during device binding. This can lead to out-of-bounds memory access when the device is manually bound via sysfs with an invalid index like -1.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA dummy driver. Detection requires checking the kernel version and verifying if the vulnerable code path exists. Use uname -a to check the kernel version and grep for the affected function in the kernel source or running system.

Impact Analysis

An attacker with local access could exploit this to cause a system crash or potentially execute arbitrary code with kernel privileges. It may also lead to memory corruption or denial of service on affected systems.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized code execution or data access, violating integrity and confidentiality requirements in standards like GDPR and HIPAA. Systems handling sensitive data must ensure kernel vulnerabilities are patched to maintain compliance.

Mitigation Strategies

Update the Linux kernel to a patched version where this vulnerability is fixed. If immediate patching is not possible, avoid manually binding devices via sysfs to prevent triggering the OOB access issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80812. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart