CVE-2026-80969

Received Received - Intake

MPU401 Driver Card Index Validation Flaw in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: mpu401: Check card index validity at probe mpu401 driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-80969

EUVD

EUVD-2026-76292

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's ALSA mpu401 driver. The driver fails to validate the card index value during device probing. When a device is manually bound via sysfs, the index can be set to -1, leading to out-of-bounds memory access in the driver's index array and other parameters.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA mpu401 driver and may not have direct network detection methods. Check kernel logs for mpu401-related errors or warnings using 'dmesg | grep mpu401' or 'journalctl -k | grep mpu401'. Verify if the driver is loaded with 'lsmod | grep snd_mpu401'.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger memory corruption in the kernel, potentially causing system crashes, privilege escalation, or other malicious activities. It affects systems using the mpu401 driver.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel driver issue that could lead to out-of-bounds memory access, but no evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-80969. Avoid manually binding mpu401 devices via sysfs if possible. Monitor kernel logs for unusual activity related to the driver.

Hi! I’m here to help you understand CVE-2026-80969. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70