Bug 2532220 (CVE-2026-80968) - CVE-2026-80968 kernel: Linux kernel ALSA mts64 driver: Out-of-bounds access via invalid card index
Summary: CVE-2026-80968 kernel: Linux kernel ALSA mts64 driver: Out-of-bounds access v...
Keywords:
Status: NEW
Alias: CVE-2026-80968
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-11 21:28 UTC by OSIDB Bzimport
Modified: 2026-09-11 21:52 UTC (History)
15 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-11 21:28:07 UTC
In the Linux kernel, the following vulnerability has been resolved:

ALSA: mts64: Check card index validity at probe

Although mts64 driver has a check of the given devptr->id value, it
doesn't check for a negative id, which is often given as "none" or
such value when bound via sysfs.  This may lead to OOB access for
index[] and other parameters.

Add a sanity check for the card index and warn/correct it if it's a
value out of the range.


Note You need to log in before you can comment on or make changes to this bug.