Linux Kernel ALSA Vulnerability in Virtio-snd Control Handling

CVE-2026-64490

What is CVE-2026-64490?

A vulnerability in the Linux kernel's ALSA subsystem for virtio-snd control handling has been identified. The issue arises when the control type and value count provided by the device are not properly validated. This flaw allows a buggy or malicious device to potentially manipulate the control metadata, leading to out-of-bounds access during operations that utilize the g_v2a_type_map and fixed-size arrays. The vulnerability can be exploited through crafted device responses, making it essential for the control type and count to be validated in the parsing function to enhance security.

References