CVE-2026-80964

Received Received - Intake

Linux Kernel ALSA virmidi Card Index Validation Flaw

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: virmidi: Check card index validity at probe virmidi driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-80964

EUVD

EUVD-2026-76287

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's ALSA virmidi driver. The driver fails to validate the card index value during device probe, which can lead to out-of-bounds memory access if a device is manually bound via sysfs with an invalid index like -1. A sanity check has been added to prevent this issue.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA virmidi driver and involves improper handling of card index values. Detection requires checking kernel logs for virmidi-related errors or examining the driver's behavior during device probing. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger a system crash or potentially execute arbitrary code by exploiting the out-of-bounds access in the virmidi driver. It may also lead to memory corruption or privilege escalation on affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a Linux kernel driver issue involving out-of-bounds access due to invalid card index handling, which could lead to system instability or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Update your Linux kernel to the latest patched version where this issue is resolved. Avoid manually binding virmidi devices via sysfs to prevent potential OOB access. Monitor kernel logs for virmidi-related errors as a sign of exploitation.

Hi! I’m here to help you understand CVE-2026-80964. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70