CVE-2026-80972

Received Received - Intake

ALSA aloop Card Index Validation Flaw

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Check card index validity at probe aloop driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-80972

EUVD

EUVD-2026-76295

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's ALSA aloop driver. The driver fails to validate the card index value during device probing. When a device is manually bound via sysfs, the index could be set to -1, leading to out-of-bounds memory access in the driver's internal arrays.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA aloop driver and requires kernel-level inspection. Check if your kernel version includes the fix by running uname -a and comparing against patched versions. Monitor kernel logs for aloop-related errors or warnings using dmesg | grep aloop.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger a kernel crash or potentially execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions or privilege escalation on affected systems.

Mitigation Strategies

Update your Linux kernel to a version containing the fix for CVE-2026-80972. If immediate patching is not possible, restrict manual device binding via sysfs to prevent untrusted access. Monitor system logs for anomalous aloop behavior.

Hi! I’m here to help you understand CVE-2026-80972. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70