{"id":"CVE-2026-64490","title":"ALSA: virtio: Validate control metadata from the device","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: virtio: Validate control metadata from the device\n\nvirtio-snd control handling trusts the device-provided control type and\nvalue count returned by the device.\n\nTh…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 < 3243563f99ef5d3949b934bd6390a5679405d0e1","Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 < 5da9742de22db0dbaa8d414214ab5e1bedde00f9","Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 < 21584672fd699abe1768241d6c501b2de6139b6a","Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 < c77a6cbb36ff8cbc1f084d94f8dcda5250935271","Linux 6.9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:41:24.261293Z"},"published":"2026-07-25","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:42:38.456Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64490","references":[{"url":"https://git.kernel.org/stable/c/3243563f99ef5d3949b934bd6390a5679405d0e1"},{"url":"https://git.kernel.org/stable/c/5da9742de22db0dbaa8d414214ab5e1bedde00f9"},{"url":"https://git.kernel.org/stable/c/21584672fd699abe1768241d6c501b2de6139b6a"},{"url":"https://git.kernel.org/stable/c/c77a6cbb36ff8cbc1f084d94f8dcda5250935271"}],"tags":["cve.org"],"epss":0.00153,"epssPercentile":0.03986,"ingestedAt":"2026-10-16T17:24:46.824Z","slug":"CVE-2026-64490","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nALSA: virtio: Validate control metadata from the device\n\nvirtio-snd control handling trusts the device-provided control type and\nvalue count returned by the device.\n\nThat metadata is then used directly to index g_v2a_type_map[] in\nvirtsnd_kctl_info(), and to size loops and memcpy() operations in\nvirtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size\nvirtio_snd_ctl_value and snd_ctl_elem_value arrays.\n\nA buggy or malicious device can therefore trigger out-of-bounds access by\nadvertising an invalid control type or an oversized value count.\n\nValidate control type and count once in virtsnd_kctl_parse_cfg(), before\nquerying enumerated items or exposing the control to ALSA.\n\n## Affected\n\n- `Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 < 3243563f99ef5d3949b934bd6390a5679405d0e1`\n- `Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 < 5da9742de22db0dbaa8d414214ab5e1bedde00f9`\n- `Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 < 21584672fd699abe1768241d6c501b2de6139b6a`\n- `Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 < c77a6cbb36ff8cbc1f084d94f8dcda5250935271`\n- `Linux 6.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}