{"id":"CVE-2026-64490","summary":"ALSA: virtio: Validate control metadata from the device","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: virtio: Validate control metadata from the device\n\nvirtio-snd control handling trusts the device-provided control type and\nvalue count returned by the device.\n\nThat metadata is then used directly to index g_v2a_type_map[] in\nvirtsnd_kctl_info(), and to size loops and memcpy() operations in\nvirtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size\nvirtio_snd_ctl_value and snd_ctl_elem_value arrays.\n\nA buggy or malicious device can therefore trigger out-of-bounds access by\nadvertising an invalid control type or an oversized value count.\n\nValidate control type and count once in virtsnd_kctl_parse_cfg(), before\nquerying enumerated items or exposing the control to ALSA.","modified":"2026-08-18T03:31:11.474485602Z","published":"2026-07-25T08:51:48.877Z","related":["openSUSE-SU-2026:11476-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64490.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/21584672fd699abe1768241d6c501b2de6139b6a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3243563f99ef5d3949b934bd6390a5679405d0e1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5da9742de22db0dbaa8d414214ab5e1bedde00f9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c77a6cbb36ff8cbc1f084d94f8dcda5250935271"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64490.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64490"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"d6568e3de42dd971a1356f7ba581e6600d53f0a0"},{"fixed":"3243563f99ef5d3949b934bd6390a5679405d0e1"},{"fixed":"5da9742de22db0dbaa8d414214ab5e1bedde00f9"},{"fixed":"21584672fd699abe1768241d6c501b2de6139b6a"},{"fixed":"c77a6cbb36ff8cbc1f084d94f8dcda5250935271"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64490.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.9.0"},{"fixed":"6.12.96"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.39"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64490.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}