---
id: CVE-2026-64490
title: 'ALSA: virtio: Validate control metadata from the device'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: virtio: Validate control metadata from the device

  virtio-snd control handling trusts the device-provided control type and
  value count returned by the device.

  Th…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 <
    3243563f99ef5d3949b934bd6390a5679405d0e1
  - >-
    Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 <
    5da9742de22db0dbaa8d414214ab5e1bedde00f9
  - >-
    Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 <
    21584672fd699abe1768241d6c501b2de6139b6a
  - >-
    Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 <
    c77a6cbb36ff8cbc1f084d94f8dcda5250935271
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:41:24.261293Z'
published: '2026-07-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:38.456Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64490'
references:
  - url: 'https://git.kernel.org/stable/c/3243563f99ef5d3949b934bd6390a5679405d0e1'
  - url: 'https://git.kernel.org/stable/c/5da9742de22db0dbaa8d414214ab5e1bedde00f9'
  - url: 'https://git.kernel.org/stable/c/21584672fd699abe1768241d6c501b2de6139b6a'
  - url: 'https://git.kernel.org/stable/c/c77a6cbb36ff8cbc1f084d94f8dcda5250935271'
tags:
  - cve.org
epss: 0.00153
epssPercentile: 0.03986
ingestedAt: '2026-10-16T17:24:46.824Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: virtio: Validate control metadata from the device

virtio-snd control handling trusts the device-provided control type and
value count returned by the device.

That metadata is then used directly to index g_v2a_type_map[] in
virtsnd_kctl_info(), and to size loops and memcpy() operations in
virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size
virtio_snd_ctl_value and snd_ctl_elem_value arrays.

A buggy or malicious device can therefore trigger out-of-bounds access by
advertising an invalid control type or an oversized value count.

Validate control type and count once in virtsnd_kctl_parse_cfg(), before
querying enumerated items or exposing the control to ALSA.

## Affected

- `Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 < 3243563f99ef5d3949b934bd6390a5679405d0e1`
- `Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 < 5da9742de22db0dbaa8d414214ab5e1bedde00f9`
- `Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 < 21584672fd699abe1768241d6c501b2de6139b6a`
- `Linux >= d6568e3de42dd971a1356f7ba581e6600d53f0a0 < c77a6cbb36ff8cbc1f084d94f8dcda5250935271`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.