CVE-2026-80965

Received Received - Intake

Out-of-Bounds Access in Linux Kernel ALSA serial-u16550 Driver

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: serial-u16550: Check card index validity at probe serial-u16550 driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-80965

EUVD

EUVD-2026-76288

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the serial-u16550 driver. The driver fails to validate the card index value during device probing. Normally, the driver creates devices with valid indices, but if a device is manually bound via the sysfs interface, the index could be set to -1 (indicating 'none'). This leads to out-of-bounds (OOB) memory access when the driver tries to use the invalid index for array access or other operations.

Detection Guidance

This vulnerability affects the Linux kernel's serial-u16550 driver and involves improper handling of card index values during device probing. To detect it, check kernel logs for errors related to the serial-u16550 driver or OOB (out-of-bounds) access warnings during system boot or device probing. Commands like 'dmesg | grep -i serial-u16550' or 'journalctl -k | grep -i serial-u16550' may help identify such issues.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a denial-of-service (DoS) condition or potentially execute arbitrary code on the affected system. The OOB access might crash the kernel or corrupt memory, leading to system instability or unauthorized access.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate kernel update is not possible, avoid manually binding devices via sysfs to the serial-u16550 driver. Monitor kernel logs for any signs of exploitation or unusual activity related to this driver.

Hi! I’m here to help you understand CVE-2026-80965. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70