CVE-2026-80968

Received Received - Intake

Out-of-Bounds Access in Linux Kernel ALSA mts64 Driver

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: mts64: Check card index validity at probe Although mts64 driver has a check of the given devptr->id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via sysfs. This may lead to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-30

NVD

CVE-2026-80968

EUVD

EUVD-2026-76291

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's ALSA mts64 driver. It occurs when a negative card index value is provided during driver probe, typically via sysfs. The driver fails to validate this negative index, leading to potential out-of-bounds memory access when accessing arrays like index[]. A sanity check has been added to prevent invalid card indices.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA mts64 driver and requires checking for improper card index handling during driver probe. No direct commands are provided in the context to detect this issue. You may need to inspect kernel logs for errors related to mts64 or check driver initialization logs.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a system crash or execute arbitrary code by triggering an out-of-bounds memory access. It may lead to denial-of-service conditions or privilege escalation if exploited successfully.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other common standards and regulations. The issue is specific to a Linux kernel driver (mts64) and involves potential out-of-bounds access due to an unchecked negative card index during probe. No evidence suggests this vulnerability impacts data protection, privacy, or security controls required by GDPR or HIPAA.

Mitigation Strategies

Apply the latest kernel updates from your Linux distribution to ensure the mts64 driver includes the card index validity check. If you cannot update immediately, avoid using the mts64 driver or unload it if already loaded.

Hi! I’m here to help you understand CVE-2026-80968. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70