CVE-2026-80966

Received Received - Intake

Out-of-Bounds Access in Linux Kernel ALSA Portman2x4 Driver

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: portman2x4: Check card index validity at probe Although portman2x4 driver has a check of the given devptr->id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via sysfs. This may lead to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-80966

EUVD

EUVD-2026-76289

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's ALSA portman2x4 driver. It occurs because the driver does not validate if the card index is negative during the probe process. A negative index can be provided via sysfs when binding the device, leading to out-of-bounds memory access in the driver's index array and other parameters.

Detection Guidance

This vulnerability affects the ALSA portman2x4 driver in the Linux kernel. Detection requires checking if the driver is loaded and if the system is running a vulnerable kernel version. Use commands like 'lsmod | grep portman2x4' to check if the driver is loaded and 'uname -r' to verify the kernel version.

Impact Analysis

This vulnerability may allow an attacker with local access to cause a system crash, memory corruption, or potentially execute arbitrary code with kernel privileges. It could lead to denial-of-service conditions or privilege escalation on affected systems.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. If the portman2x4 driver is not in use, consider unloading it with 'rmmod portman2x4' to prevent potential exploitation.

Hi! I’m here to help you understand CVE-2026-80966. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70