CVE-2026-64490 (GCVE-0-2026-64490)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-08-17 04:56
VLAI
Title
ALSA: virtio: Validate control metadata from the device
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used directly to index g_v2a_type_map[] in virtsnd_kctl_info(), and to size loops and memcpy() operations in virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size virtio_snd_ctl_value and snd_ctl_elem_value arrays. A buggy or malicious device can therefore trigger out-of-bounds access by advertising an invalid control type or an oversized value count. Validate control type and count once in virtsnd_kctl_parse_cfg(), before querying enumerated items or exposing the control to ALSA.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d6568e3de42dd971a1356f7ba581e6600d53f0a0 , < 3243563f99ef5d3949b934bd6390a5679405d0e1 (git)
Affected: d6568e3de42dd971a1356f7ba581e6600d53f0a0 , < 5da9742de22db0dbaa8d414214ab5e1bedde00f9 (git)
Affected: d6568e3de42dd971a1356f7ba581e6600d53f0a0 , < 21584672fd699abe1768241d6c501b2de6139b6a (git)
Affected: d6568e3de42dd971a1356f7ba581e6600d53f0a0 , < c77a6cbb36ff8cbc1f084d94f8dcda5250935271 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/virtio/virtio_kctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3243563f99ef5d3949b934bd6390a5679405d0e1",
              "status": "affected",
              "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
              "versionType": "git"
            },
            {
              "lessThan": "5da9742de22db0dbaa8d414214ab5e1bedde00f9",
              "status": "affected",
              "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
              "versionType": "git"
            },
            {
              "lessThan": "21584672fd699abe1768241d6c501b2de6139b6a",
              "status": "affected",
              "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
              "versionType": "git"
            },
            {
              "lessThan": "c77a6cbb36ff8cbc1f084d94f8dcda5250935271",
              "status": "affected",
              "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/virtio/virtio_kctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: virtio: Validate control metadata from the device\n\nvirtio-snd control handling trusts the device-provided control type and\nvalue count returned by the device.\n\nThat metadata is then used directly to index g_v2a_type_map[] in\nvirtsnd_kctl_info(), and to size loops and memcpy() operations in\nvirtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size\nvirtio_snd_ctl_value and snd_ctl_elem_value arrays.\n\nA buggy or malicious device can therefore trigger out-of-bounds access by\nadvertising an invalid control type or an oversized value count.\n\nValidate control type and count once in virtsnd_kctl_parse_cfg(), before\nquerying enumerated items or exposing the control to ALSA."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed metadata arrives through a locally attached virtio-snd device/backend and reaches vulnerable ALSA callbacks through local control operations. No routable network path or physical attachment is required.\nAC:L - The backend directly controls the type, count, access flags, and returned values, allowing deterministic oversized loops or copies without a race. Repeated control notifications and operations permit reliable triggering and heap grooming.\nPR:N - A malicious virtio backend supplies metadata during device initialization without guest authentication or capability checks. Standard OSS mixer registration or an automatically running audio service can subsequently access the control without the attacker holding guest credentials.\nUI:N - No human action is required because OSS mixer construction and normal audio-service enumeration can query or operate newly registered controls automatically. The backend can also generate control-change notifications to provoke further accesses.\nS:U - The vulnerable driver and corrupted kernel memory are within the same guest-kernel security authority. This is host-to-guest device exploitation, not a guest-to-host escape or IOMMU-boundary bypass.\nC:H - Oversized read operations copy data beyond the fixed 512-byte response into the userspace-returned ALSA value structure, exposing adjacent kernel heap contents. The unchecked type-map index also provides a device-selected out-of-bounds kernel read.\nI:H - Oversized INTEGER64, ENUMERATED, and BYTES write operations copy control values beyond the 512-byte virtio request payload into adjacent kernel heap objects. This controlled heap corruption can plausibly provide arbitrary modification or control-flow hijacking.\nA:H - Invalid type indices, enormous loops or memcpy lengths, and resulting heap corruption can cause an immediate kernel fault, oops, panic, or hang. The malicious backend can trigger the condition repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:56:38.207Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3243563f99ef5d3949b934bd6390a5679405d0e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/5da9742de22db0dbaa8d414214ab5e1bedde00f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/21584672fd699abe1768241d6c501b2de6139b6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c77a6cbb36ff8cbc1f084d94f8dcda5250935271"
        }
      ],
      "title": "ALSA: virtio: Validate control metadata from the device",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64490",
    "datePublished": "2026-07-25T08:51:48.877Z",
    "dateReserved": "2026-07-19T15:36:31.792Z",
    "dateUpdated": "2026-08-17T04:56:38.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64490",
      "date": "2026-09-30",
      "epss": "0.00196",
      "percentile": "0.08323"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "sound/virtio/virtio_kctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3243563f99ef5d3949b934bd6390a5679405d0e1",
                    "status": "affected",
                    "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5da9742de22db0dbaa8d414214ab5e1bedde00f9",
                    "status": "affected",
                    "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "21584672fd699abe1768241d6c501b2de6139b6a",
                    "status": "affected",
                    "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c77a6cbb36ff8cbc1f084d94f8dcda5250935271",
                    "status": "affected",
                    "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "sound/virtio/virtio_kctl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.9"
                  },
                  {
                    "lessThan": "6.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.96",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: virtio: Validate control metadata from the device\n\nvirtio-snd control handling trusts the device-provided control type and\nvalue count returned by the device.\n\nThat metadata is then used directly to index g_v2a_type_map[] in\nvirtsnd_kctl_info(), and to size loops and memcpy() operations in\nvirtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size\nvirtio_snd_ctl_value and snd_ctl_elem_value arrays.\n\nA buggy or malicious device can therefore trigger out-of-bounds access by\nadvertising an invalid control type or an oversized value count.\n\nValidate control type and count once in virtsnd_kctl_parse_cfg(), before\nquerying enumerated items or exposing the control to ALSA."
          }
        ],
        "id": "CVE-2026-64490",
        "lastModified": "2026-08-17T05:17:54.887",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:34.807",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/21584672fd699abe1768241d6c501b2de6139b6a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3243563f99ef5d3949b934bd6390a5679405d0e1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5da9742de22db0dbaa8d414214ab5e1bedde00f9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c77a6cbb36ff8cbc1f084d94f8dcda5250935271"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-28T20:11:03+00:00",
      "cve": "CVE-2026-64490",
      "id": "CVE-2026-64490",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ALSA: virtio: Validate control metadata from the device",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64490.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:52:30Z",
      "cve": "CVE-2026-64490",
      "id": "CVE-2026-64490",
      "initial_release_date": "2026-07-25T15:58:22Z",
      "product_status:first_fixed": "60",
      "product_status:known_not_affected": "376",
      "product_status:recommended": "87",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64490",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64490.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.