FKIE_CVE-2026-74640
Vulnerability from fkie_nvd - Published: 2026-08-22 16:16 - Updated: 2026-10-16 20:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
fcp_ioctl_set_meter_map() bounds the user-supplied Level Meter map size
by the driver's own limit of 255
if (map.map_size < 1 || map.map_size > 255 ||
map.meter_slots < 1 || map.meter_slots > 255)
return -EINVAL;
and passes it to fcp_add_new_ctl() as the control's channel count, where
it is stored as elem->channels.
Every control read writes into struct snd_ctl_elem_value, whose integer
array is declared long value[128], so the limit is 128, not 255.
fcp_meter_ctl_get() stores one 64-bit word per channel into that array
with no bound of its own:
for (i = 0; i < elem->channels; i++) {
int idx = private->meter_level_map[i];
int value = idx < 0 ? 0 : le32_to_cpu(resp[idx]);
ucontrol->value.integer.value[i] = value;
}
snd_ctl_elem_read_user() serves that object from
memdup_user(_control, sizeof(*control)), 1224 bytes on LP64 out of
kmalloc-2048. offsetof(struct snd_ctl_elem_value, value) is 72, so
element i is written at byte 72 + 8 * i and element 144 already lands
past the allocation. At map_size 255 the last store ends at byte 2112,
888 bytes past the object and 64 bytes into the adjacent slab object.
The stored words come from the device and meter_level_map[] selects
which word lands in which slot, so extent and contents are both
controlled.
The core does not catch this. snd_ctl_check_elem_info() is reached only
from __snd_ctl_elem_info(), which snd_ctl_elem_read() calls under
CONFIG_SND_CTL_DEBUG; without that option snd_ctl_skip_validation() is a
compile-time true. __snd_ctl_add_replace() validates kcontrol->count and
never inspects elem->channels.
Installing an oversized map needs CAP_SYS_RAWIO, but the control outlives
the hwdep descriptor that created it, so the out-of-bounds stores are
issued by any process able to read controls on /dev/snd/controlC0.
KASAN on 7.2.0-rc5 (arm64), triggered by an unprivileged control read:
BUG: KASAN: slab-out-of-bounds in fcp_meter_ctl_get
Write of size 8 at addr ffff000017af04c8 by task fcp_trigger/185
__asan_store8
fcp_meter_ctl_get
snd_ctl_elem_read
snd_ctl_ioctl
Allocated by task 185:
memdup_user
snd_ctl_ioctl
The buggy address is located 0 bytes to the right of
allocated 1224-byte region [ffff000017af0000, ffff000017af04c8)
Bound the map size by the ABI limit rather than by 255, and bound the
store loop at the sink so it cannot run past the value array whatever
elem->channels holds.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/fcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bb30e35c36ed00f24fa39aded811f64230a913b0",
"status": "affected",
"version": "46757a3e7d50dac923888e7fbe68377736f13c70",
"versionType": "git"
},
{
"lessThan": "bb61dc2ae59026f76db26e1909746908bc5b6f31",
"status": "affected",
"version": "46757a3e7d50dac923888e7fbe68377736f13c70",
"versionType": "git"
},
{
"lessThan": "620f1e52a46f604635efd0fb78138afd6a513b5d",
"status": "affected",
"version": "46757a3e7d50dac923888e7fbe68377736f13c70",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/fcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: FCP: fix OOB write in fcp_meter_ctl_get()\n\nfcp_ioctl_set_meter_map() bounds the user-supplied Level Meter map size\nby the driver\u0027s own limit of 255\n\n\tif (map.map_size \u003c 1 || map.map_size \u003e 255 ||\n\t map.meter_slots \u003c 1 || map.meter_slots \u003e 255)\n\t\treturn -EINVAL;\n\nand passes it to fcp_add_new_ctl() as the control\u0027s channel count, where\nit is stored as elem-\u003echannels.\n\nEvery control read writes into struct snd_ctl_elem_value, whose integer\narray is declared long value[128], so the limit is 128, not 255.\nfcp_meter_ctl_get() stores one 64-bit word per channel into that array\nwith no bound of its own:\n\n\tfor (i = 0; i \u003c elem-\u003echannels; i++) {\n\t\tint idx = private-\u003emeter_level_map[i];\n\t\tint value = idx \u003c 0 ? 0 : le32_to_cpu(resp[idx]);\n\n\t\tucontrol-\u003evalue.integer.value[i] = value;\n\t}\n\nsnd_ctl_elem_read_user() serves that object from\nmemdup_user(_control, sizeof(*control)), 1224 bytes on LP64 out of\nkmalloc-2048. offsetof(struct snd_ctl_elem_value, value) is 72, so\nelement i is written at byte 72 + 8 * i and element 144 already lands\npast the allocation. At map_size 255 the last store ends at byte 2112,\n888 bytes past the object and 64 bytes into the adjacent slab object.\nThe stored words come from the device and meter_level_map[] selects\nwhich word lands in which slot, so extent and contents are both\ncontrolled.\n\nThe core does not catch this. snd_ctl_check_elem_info() is reached only\nfrom __snd_ctl_elem_info(), which snd_ctl_elem_read() calls under\nCONFIG_SND_CTL_DEBUG; without that option snd_ctl_skip_validation() is a\ncompile-time true. __snd_ctl_add_replace() validates kcontrol-\u003ecount and\nnever inspects elem-\u003echannels.\n\nInstalling an oversized map needs CAP_SYS_RAWIO, but the control outlives\nthe hwdep descriptor that created it, so the out-of-bounds stores are\nissued by any process able to read controls on /dev/snd/controlC0.\n\nKASAN on 7.2.0-rc5 (arm64), triggered by an unprivileged control read:\n\n BUG: KASAN: slab-out-of-bounds in fcp_meter_ctl_get\n Write of size 8 at addr ffff000017af04c8 by task fcp_trigger/185\n __asan_store8\n fcp_meter_ctl_get\n snd_ctl_elem_read\n snd_ctl_ioctl\n Allocated by task 185:\n memdup_user\n snd_ctl_ioctl\n The buggy address is located 0 bytes to the right of\n allocated 1224-byte region [ffff000017af0000, ffff000017af04c8)\n\nBound the map size by the ABI limit rather than by 255, and bound the\nstore loop at the sink so it cannot run past the value array whatever\nelem-\u003echannels holds.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: FCP: correcci\u00f3n de escritura fuera de l\u00edmites en fcp_meter_ctl_get()\n\nfcp_ioctl_set_meter_map() limita el tama\u00f1o del mapa del medidor de nivel proporcionado por el usuario por el propio l\u00edmite del controlador de 255\n\n\tif (map.map_size \u003c 1 || map.map_size \u003e 255 ||\n\t map.meter_slots \u003c 1 || map.meter_slots \u003e 255)\n\t\treturn -EINVAL;\n\ny lo pasa a fcp_add_new_ctl() como el recuento de canales del control, donde se almacena como elem -\u003e channels.\n\nCada lectura de control escribe en struct snd_ctl_elem_value, cuyo array de enteros se declara long value[128], por lo que el l\u00edmite es 128, no 255.\nfcp_meter_ctl_get() almacena una palabra de 64 bits por canal en ese array sin un l\u00edmite propio:\n\n\tfor (i = 0; i \u003c elem -\u003e channels; i++) {\n\t\tint idx = private -\u003e meter_level_map[i];\n\t\tint value = idx \u003c 0 ? 0 : le32_to_cpu(resp[idx]);\n\n\t\tucontrol -\u003e value.integer.value[i] = value;\n\t}\n\nsnd_ctl_elem_read_user() sirve ese objeto desde memdup_user(_control, sizeof(control)), 1224 bytes en LP64 de kmalloc-2048. offsetof(struct snd_ctl_elem_value, value) es 72, por lo que el elemento i se escribe en el byte 72 + 8 * i y el elemento 144 ya cae m\u00e1s all\u00e1 de la asignaci\u00f3n. Con map_size 255, el \u00faltimo almacenamiento termina en el byte 2112, 888 bytes m\u00e1s all\u00e1 del objeto y 64 bytes dentro del objeto slab adyacente. Las palabras almacenadas provienen del dispositivo y meter_level_map[] selecciona qu\u00e9 palabra cae en qu\u00e9 ranura, por lo que tanto la extensi\u00f3n como el contenido est\u00e1n controlados.\n\nEl n\u00facleo no detecta esto. snd_ctl_check_elem_info() solo se alcanza desde __snd_ctl_elem_info(), que snd_ctl_elem_read() llama bajo CONFIG_SND_CTL_DEBUG; sin esa opci\u00f3n, snd_ctl_skip_validation() es un verdadero en tiempo de compilaci\u00f3n. __snd_ctl_add_replace() valida kcontrol -\u003e count y nunca inspecciona elem -\u003e channels.\n\nInstalar un mapa de tama\u00f1o excesivo requiere CAP_SYS_RAWIO, pero el control sobrevive al descriptor hwdep que lo cre\u00f3, por lo que los almacenamientos fuera de l\u00edmites son emitidos por cualquier proceso capaz de leer controles en /dev/snd/controlC0.\n\nKASAN en 7.2.0-rc5 (arm64), activado por una lectura de control sin privilegios:\n\n BUG: KASAN: slab-out-of-bounds en fcp_meter_ctl_get\n Escritura de tama\u00f1o 8 en la direcci\u00f3n ffff000017af04c8 por la tarea fcp_trigger/185\n __asan_store8\n fcp_meter_ctl_get\n snd_ctl_elem_read\n snd_ctl_ioctl\n Asignado por la tarea 185:\n memdup_user\n snd_ctl_ioctl\n La direcci\u00f3n err\u00f3nea se encuentra 0 bytes a la derecha de\n regi\u00f3n asignada de 1224 bytes [ffff000017af0000, ffff000017af04c8)\n\nLimitar el tama\u00f1o del mapa por el l\u00edmite ABI en lugar de por 255, y limitar el bucle de almacenamiento en el sumidero para que no pueda ir m\u00e1s all\u00e1 del array de valores, independientemente de lo que contenga elem -\u003e channels.\n\nDescubierto por XBOW, clasificado por Baul Lee \u003cbaul.lee@xbow.com\u003e"
}
],
"id": "CVE-2026-74640",
"lastModified": "2026-10-16T20:17:48.987",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-74640",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:03:29.066751Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-22T16:16:37.267",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/620f1e52a46f604635efd0fb78138afd6a513b5d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/bb30e35c36ed00f24fa39aded811f64230a913b0"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/bb61dc2ae59026f76db26e1909746908bc5b6f31"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.