CVE-2026-74640 (GCVE-0-2026-74640)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41
VLAI
Title
ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcp_meter_ctl_get() fcp_ioctl_set_meter_map() bounds the user-supplied Level Meter map size by the driver's own limit of 255 if (map.map_size < 1 || map.map_size > 255 || map.meter_slots < 1 || map.meter_slots > 255) return -EINVAL; and passes it to fcp_add_new_ctl() as the control's channel count, where it is stored as elem->channels. Every control read writes into struct snd_ctl_elem_value, whose integer array is declared long value[128], so the limit is 128, not 255. fcp_meter_ctl_get() stores one 64-bit word per channel into that array with no bound of its own: for (i = 0; i < elem->channels; i++) { int idx = private->meter_level_map[i]; int value = idx < 0 ? 0 : le32_to_cpu(resp[idx]); ucontrol->value.integer.value[i] = value; } snd_ctl_elem_read_user() serves that object from memdup_user(_control, sizeof(*control)), 1224 bytes on LP64 out of kmalloc-2048. offsetof(struct snd_ctl_elem_value, value) is 72, so element i is written at byte 72 + 8 * i and element 144 already lands past the allocation. At map_size 255 the last store ends at byte 2112, 888 bytes past the object and 64 bytes into the adjacent slab object. The stored words come from the device and meter_level_map[] selects which word lands in which slot, so extent and contents are both controlled. The core does not catch this. snd_ctl_check_elem_info() is reached only from __snd_ctl_elem_info(), which snd_ctl_elem_read() calls under CONFIG_SND_CTL_DEBUG; without that option snd_ctl_skip_validation() is a compile-time true. __snd_ctl_add_replace() validates kcontrol->count and never inspects elem->channels. Installing an oversized map needs CAP_SYS_RAWIO, but the control outlives the hwdep descriptor that created it, so the out-of-bounds stores are issued by any process able to read controls on /dev/snd/controlC0. KASAN on 7.2.0-rc5 (arm64), triggered by an unprivileged control read: BUG: KASAN: slab-out-of-bounds in fcp_meter_ctl_get Write of size 8 at addr ffff000017af04c8 by task fcp_trigger/185 __asan_store8 fcp_meter_ctl_get snd_ctl_elem_read snd_ctl_ioctl Allocated by task 185: memdup_user snd_ctl_ioctl The buggy address is located 0 bytes to the right of allocated 1224-byte region [ffff000017af0000, ffff000017af04c8) Bound the map size by the ABI limit rather than by 255, and bound the store loop at the sink so it cannot run past the value array whatever elem->channels holds. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 46757a3e7d50dac923888e7fbe68377736f13c70 , < bb30e35c36ed00f24fa39aded811f64230a913b0 (git)
Affected: 46757a3e7d50dac923888e7fbe68377736f13c70 , < bb61dc2ae59026f76db26e1909746908bc5b6f31 (git)
Affected: 46757a3e7d50dac923888e7fbe68377736f13c70 , < 620f1e52a46f604635efd0fb78138afd6a513b5d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/fcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bb30e35c36ed00f24fa39aded811f64230a913b0",
              "status": "affected",
              "version": "46757a3e7d50dac923888e7fbe68377736f13c70",
              "versionType": "git"
            },
            {
              "lessThan": "bb61dc2ae59026f76db26e1909746908bc5b6f31",
              "status": "affected",
              "version": "46757a3e7d50dac923888e7fbe68377736f13c70",
              "versionType": "git"
            },
            {
              "lessThan": "620f1e52a46f604635efd0fb78138afd6a513b5d",
              "status": "affected",
              "version": "46757a3e7d50dac923888e7fbe68377736f13c70",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/fcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: FCP: fix OOB write in fcp_meter_ctl_get()\n\nfcp_ioctl_set_meter_map() bounds the user-supplied Level Meter map size\nby the driver\u0027s own limit of 255\n\n\tif (map.map_size \u003c 1 || map.map_size \u003e 255 ||\n\t    map.meter_slots \u003c 1 || map.meter_slots \u003e 255)\n\t\treturn -EINVAL;\n\nand passes it to fcp_add_new_ctl() as the control\u0027s channel count, where\nit is stored as elem-\u003echannels.\n\nEvery control read writes into struct snd_ctl_elem_value, whose integer\narray is declared long value[128], so the limit is 128, not 255.\nfcp_meter_ctl_get() stores one 64-bit word per channel into that array\nwith no bound of its own:\n\n\tfor (i = 0; i \u003c elem-\u003echannels; i++) {\n\t\tint idx = private-\u003emeter_level_map[i];\n\t\tint value = idx \u003c 0 ? 0 : le32_to_cpu(resp[idx]);\n\n\t\tucontrol-\u003evalue.integer.value[i] = value;\n\t}\n\nsnd_ctl_elem_read_user() serves that object from\nmemdup_user(_control, sizeof(*control)), 1224 bytes on LP64 out of\nkmalloc-2048.  offsetof(struct snd_ctl_elem_value, value) is 72, so\nelement i is written at byte 72 + 8 * i and element 144 already lands\npast the allocation.  At map_size 255 the last store ends at byte 2112,\n888 bytes past the object and 64 bytes into the adjacent slab object.\nThe stored words come from the device and meter_level_map[] selects\nwhich word lands in which slot, so extent and contents are both\ncontrolled.\n\nThe core does not catch this.  snd_ctl_check_elem_info() is reached only\nfrom __snd_ctl_elem_info(), which snd_ctl_elem_read() calls under\nCONFIG_SND_CTL_DEBUG; without that option snd_ctl_skip_validation() is a\ncompile-time true.  __snd_ctl_add_replace() validates kcontrol-\u003ecount and\nnever inspects elem-\u003echannels.\n\nInstalling an oversized map needs CAP_SYS_RAWIO, but the control outlives\nthe hwdep descriptor that created it, so the out-of-bounds stores are\nissued by any process able to read controls on /dev/snd/controlC0.\n\nKASAN on 7.2.0-rc5 (arm64), triggered by an unprivileged control read:\n\n  BUG: KASAN: slab-out-of-bounds in fcp_meter_ctl_get\n  Write of size 8 at addr ffff000017af04c8 by task fcp_trigger/185\n   __asan_store8\n   fcp_meter_ctl_get\n   snd_ctl_elem_read\n   snd_ctl_ioctl\n  Allocated by task 185:\n   memdup_user\n   snd_ctl_ioctl\n  The buggy address is located 0 bytes to the right of\n   allocated 1224-byte region [ffff000017af0000, ffff000017af04c8)\n\nBound the map size by the ABI limit rather than by 255, and bound the\nstore loop at the sink so it cannot run past the value array whatever\nelem-\u003echannels holds.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation is triggered by a local process issuing SNDRV_CTL_IOCTL_ELEM_READ on /dev/snd/controlC0, which reaches fcp_meter_ctl_get() via snd_ctl_elem_read_user(); there is no network, Bluetooth, or remote packet path to this code.\nAC:L - After a Level Meter map with map_size above 128 is configured, each control read deterministically performs up to 888 bytes of out-of-bounds 64-bit stores past the kmalloc-2048 buffer; no races or attacker-uncontrollable timing are required.\nPR:L - KASAN reproduced the slab OOB write from an unprivileged control read; snd_ctl_open has no capability check and the Level Meter control persists after hwdep close, so any local user with /dev/snd/controlC0 access can trigger it after normal fcp-server setup.\nUI:N - The attacker directly opens /dev/snd/controlC0 and issues the elem-read ioctl themselves; no separate victim action such as opening a file or mounting a filesystem is required.\nS:U - Impact is kernel heap corruption and local privilege escalation within the host kernel; it does not cross VM, container, or IOMMU security boundaries.\nC:H - Out-of-bounds writes corrupt up to 888 bytes beyond snd_ctl_elem_value into adjacent slab objects; attacker-influenced meter_level_map selects written values, enabling heap grooming and potential arbitrary kernel memory disclosure.\nI:H - Unbounded 64-bit stores past the 128-element value array corrupt adjacent kmalloc-2048 slab data with partially attacker-controlled contents, providing a heap corruption primitive suitable for kernel code or data overwrite.\nA:H - KASAN reported slab-out-of-bounds writes during an unprivileged control read; corrupting adjacent slab objects can cause kernel oops, panic, or hang, confirming high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:01.874Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bb30e35c36ed00f24fa39aded811f64230a913b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb61dc2ae59026f76db26e1909746908bc5b6f31"
        },
        {
          "url": "https://git.kernel.org/stable/c/620f1e52a46f604635efd0fb78138afd6a513b5d"
        }
      ],
      "title": "ALSA: FCP: fix OOB write in fcp_meter_ctl_get()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74640",
    "datePublished": "2026-08-22T15:32:18.957Z",
    "dateReserved": "2026-08-15T05:44:03.922Z",
    "dateUpdated": "2026-08-25T05:41:01.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74640",
      "date": "2026-09-01",
      "epss": "0.00127",
      "percentile": "0.02657"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74640\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:37.267\",\"lastModified\":\"2026-08-25T06:18:43.770\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: FCP: fix OOB write in fcp_meter_ctl_get()\\n\\nfcp_ioctl_set_meter_map() bounds the user-supplied Level Meter map size\\nby the driver\u0027s own limit of 255\\n\\n\\tif (map.map_size \u003c 1 || map.map_size \u003e 255 ||\\n\\t    map.meter_slots \u003c 1 || map.meter_slots \u003e 255)\\n\\t\\treturn -EINVAL;\\n\\nand passes it to fcp_add_new_ctl() as the control\u0027s channel count, where\\nit is stored as elem-\u003echannels.\\n\\nEvery control read writes into struct snd_ctl_elem_value, whose integer\\narray is declared long value[128], so the limit is 128, not 255.\\nfcp_meter_ctl_get() stores one 64-bit word per channel into that array\\nwith no bound of its own:\\n\\n\\tfor (i = 0; i \u003c elem-\u003echannels; i++) {\\n\\t\\tint idx = private-\u003emeter_level_map[i];\\n\\t\\tint value = idx \u003c 0 ? 0 : le32_to_cpu(resp[idx]);\\n\\n\\t\\tucontrol-\u003evalue.integer.value[i] = value;\\n\\t}\\n\\nsnd_ctl_elem_read_user() serves that object from\\nmemdup_user(_control, sizeof(*control)), 1224 bytes on LP64 out of\\nkmalloc-2048.  offsetof(struct snd_ctl_elem_value, value) is 72, so\\nelement i is written at byte 72 + 8 * i and element 144 already lands\\npast the allocation.  At map_size 255 the last store ends at byte 2112,\\n888 bytes past the object and 64 bytes into the adjacent slab object.\\nThe stored words come from the device and meter_level_map[] selects\\nwhich word lands in which slot, so extent and contents are both\\ncontrolled.\\n\\nThe core does not catch this.  snd_ctl_check_elem_info() is reached only\\nfrom __snd_ctl_elem_info(), which snd_ctl_elem_read() calls under\\nCONFIG_SND_CTL_DEBUG; without that option snd_ctl_skip_validation() is a\\ncompile-time true.  __snd_ctl_add_replace() validates kcontrol-\u003ecount and\\nnever inspects elem-\u003echannels.\\n\\nInstalling an oversized map needs CAP_SYS_RAWIO, but the control outlives\\nthe hwdep descriptor that created it, so the out-of-bounds stores are\\nissued by any process able to read controls on /dev/snd/controlC0.\\n\\nKASAN on 7.2.0-rc5 (arm64), triggered by an unprivileged control read:\\n\\n  BUG: KASAN: slab-out-of-bounds in fcp_meter_ctl_get\\n  Write of size 8 at addr ffff000017af04c8 by task fcp_trigger/185\\n   __asan_store8\\n   fcp_meter_ctl_get\\n   snd_ctl_elem_read\\n   snd_ctl_ioctl\\n  Allocated by task 185:\\n   memdup_user\\n   snd_ctl_ioctl\\n  The buggy address is located 0 bytes to the right of\\n   allocated 1224-byte region [ffff000017af0000, ffff000017af04c8)\\n\\nBound the map size by the ABI limit rather than by 255, and bound the\\nstore loop at the sink so it cannot run past the value array whatever\\nelem-\u003echannels holds.\\n\\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"sound/usb/fcp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"46757a3e7d50dac923888e7fbe68377736f13c70\",\"lessThan\":\"bb30e35c36ed00f24fa39aded811f64230a913b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46757a3e7d50dac923888e7fbe68377736f13c70\",\"lessThan\":\"bb61dc2ae59026f76db26e1909746908bc5b6f31\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46757a3e7d50dac923888e7fbe68377736f13c70\",\"lessThan\":\"620f1e52a46f604635efd0fb78138afd6a513b5d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"sound/usb/fcp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/620f1e52a46f604635efd0fb78138afd6a513b5d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bb30e35c36ed00f24fa39aded811f64230a913b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bb61dc2ae59026f76db26e1909746908bc5b6f31\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-25T06:06:41+00:00",
      "cve": "CVE-2026-74640",
      "id": "CVE-2026-74640",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ALSA: FCP: fix OOB write in fcp_meter_ctl_get()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74640.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.