Vulnerability-Lookup

FKIE_CVE-2026-64490

Vulnerability from fkie_nvd - Published: 2026-07-25 10:17 - Updated: 2026-07-27 05:16

Severity

8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used directly to index g_v2a_type_map[] in virtsnd_kctl_info(), and to size loops and memcpy() operations in virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size virtio_snd_ctl_value and snd_ctl_elem_value arrays. A buggy or malicious device can therefore trigger out-of-bounds access by advertising an invalid control type or an oversized value count. Validate control type and count once in virtsnd_kctl_parse_cfg(), before querying enumerated items or exposing the control to ALSA.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/21584672fd699abe1768241d6c501b2de6139b6a
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3243563f99ef5d3949b934bd6390a5679405d0e1
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5da9742de22db0dbaa8d414214ab5e1bedde00f9
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/c77a6cbb36ff8cbc1f084d94f8dcda5250935271

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/virtio/virtio_kctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3243563f99ef5d3949b934bd6390a5679405d0e1",
              "status": "affected",
              "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
              "versionType": "git"
            },
            {
              "lessThan": "5da9742de22db0dbaa8d414214ab5e1bedde00f9",
              "status": "affected",
              "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
              "versionType": "git"
            },
            {
              "lessThan": "21584672fd699abe1768241d6c501b2de6139b6a",
              "status": "affected",
              "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
              "versionType": "git"
            },
            {
              "lessThan": "c77a6cbb36ff8cbc1f084d94f8dcda5250935271",
              "status": "affected",
              "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/virtio/virtio_kctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: virtio: Validate control metadata from the device\n\nvirtio-snd control handling trusts the device-provided control type and\nvalue count returned by the device.\n\nThat metadata is then used directly to index g_v2a_type_map[] in\nvirtsnd_kctl_info(), and to size loops and memcpy() operations in\nvirtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size\nvirtio_snd_ctl_value and snd_ctl_elem_value arrays.\n\nA buggy or malicious device can therefore trigger out-of-bounds access by\nadvertising an invalid control type or an oversized value count.\n\nValidate control type and count once in virtsnd_kctl_parse_cfg(), before\nquerying enumerated items or exposing the control to ALSA."
    }
  ],
  "id": "CVE-2026-64490",
  "lastModified": "2026-07-27T05:16:54.790",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-07-25T10:17:34.807",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/21584672fd699abe1768241d6c501b2de6139b6a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3243563f99ef5d3949b934bd6390a5679405d0e1"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5da9742de22db0dbaa8d414214ab5e1bedde00f9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c77a6cbb36ff8cbc1f084d94f8dcda5250935271"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-64490 (GCVE-0-2026-64490)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-08-05 12:42

Title

ALSA: virtio: Validate control metadata from the device

Summary

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/3243563f99ef5d394…
https://git.kernel.org/stable/c/5da9742de22db0dba…
https://git.kernel.org/stable/c/21584672fd699abe1…
https://git.kernel.org/stable/c/c77a6cbb36ff8cbc1…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d6568e3de42dd971a1356f7ba581e6600d53f0a0 , < 3243563f99ef5d3949b934bd6390a5679405d0e1 (git) Affected: d6568e3de42dd971a1356f7ba581e6600d53f0a0 , < 5da9742de22db0dbaa8d414214ab5e1bedde00f9 (git) Affected: d6568e3de42dd971a1356f7ba581e6600d53f0a0 , < 21584672fd699abe1768241d6c501b2de6139b6a (git) Affected: d6568e3de42dd971a1356f7ba581e6600d53f0a0 , < c77a6cbb36ff8cbc1f084d94f8dcda5250935271 (git)
Linux	Linux	Affected: 6.9 Unaffected: 0 , < 6.9 (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/virtio/virtio_kctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3243563f99ef5d3949b934bd6390a5679405d0e1",
              "status": "affected",
              "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
              "versionType": "git"
            },
            {
              "lessThan": "5da9742de22db0dbaa8d414214ab5e1bedde00f9",
              "status": "affected",
              "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
              "versionType": "git"
            },
            {
              "lessThan": "21584672fd699abe1768241d6c501b2de6139b6a",
              "status": "affected",
              "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
              "versionType": "git"
            },
            {
              "lessThan": "c77a6cbb36ff8cbc1f084d94f8dcda5250935271",
              "status": "affected",
              "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/virtio/virtio_kctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: virtio: Validate control metadata from the device\n\nvirtio-snd control handling trusts the device-provided control type and\nvalue count returned by the device.\n\nThat metadata is then used directly to index g_v2a_type_map[] in\nvirtsnd_kctl_info(), and to size loops and memcpy() operations in\nvirtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size\nvirtio_snd_ctl_value and snd_ctl_elem_value arrays.\n\nA buggy or malicious device can therefore trigger out-of-bounds access by\nadvertising an invalid control type or an oversized value count.\n\nValidate control type and count once in virtsnd_kctl_parse_cfg(), before\nquerying enumerated items or exposing the control to ALSA."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed metadata arrives through a locally attached virtio-snd device/backend and reaches vulnerable ALSA callbacks through local control operations. No routable network path or physical attachment is required.\nAC:L - The backend directly controls the type, count, access flags, and returned values, allowing deterministic oversized loops or copies without a race. Repeated control notifications and operations permit reliable triggering and heap grooming.\nPR:N - A malicious virtio backend supplies metadata during device initialization without guest authentication or capability checks. Standard OSS mixer registration or an automatically running audio service can subsequently access the control without the attacker holding guest credentials.\nUI:N - No human action is required because OSS mixer construction and normal audio-service enumeration can query or operate newly registered controls automatically. The backend can also generate control-change notifications to provoke further accesses.\nS:U - The vulnerable driver and corrupted kernel memory are within the same guest-kernel security authority. This is host-to-guest device exploitation, not a guest-to-host escape or IOMMU-boundary bypass.\nC:H - Oversized read operations copy data beyond the fixed 512-byte response into the userspace-returned ALSA value structure, exposing adjacent kernel heap contents. The unchecked type-map index also provides a device-selected out-of-bounds kernel read.\nI:H - Oversized INTEGER64, ENUMERATED, and BYTES write operations copy control values beyond the 512-byte virtio request payload into adjacent kernel heap objects. This controlled heap corruption can plausibly provide arbitrary modification or control-flow hijacking.\nA:H - Invalid type indices, enormous loops or memcpy lengths, and resulting heap corruption can cause an immediate kernel fault, oops, panic, or hang. The malicious backend can trigger the condition repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:42:27.000Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3243563f99ef5d3949b934bd6390a5679405d0e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/5da9742de22db0dbaa8d414214ab5e1bedde00f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/21584672fd699abe1768241d6c501b2de6139b6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c77a6cbb36ff8cbc1f084d94f8dcda5250935271"
        }
      ],
      "title": "ALSA: virtio: Validate control metadata from the device",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64490",
    "datePublished": "2026-07-25T08:51:48.877Z",
    "dateReserved": "2026-07-19T15:36:31.792Z",
    "dateUpdated": "2026-08-05T12:42:27.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

FKIE_CVE-2026-64490

CVE-2026-64490 (GCVE-0-2026-64490)

Tags

Sightings

Nomenclature