ALSA: virmidi: Check card index validity at probe
Published Sep 11, 2026
5.5
MEDIUMCVSS 3.1
EPSS 0.17%
Description
virmidi driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters.
Add a sanity check for the card index and warn/correct it if it's a value out of the range.
Affected products
-
Affected
- ≥ , <
- ≥ , <
- ≥ , <
- ≥ , <
- ≥ , <
- ≥ , <
- ≥ , <
-
Affected
- 2.6.16
Unaffected
- ≥ 0, < 2.6.16
- ≥ 5.15.221, ≤ 5.15.*
- ≥ 6.1.188, ≤ 6.1.*
- ≥ 6.12.109, ≤ 6.12.*
- ≥ 6.18.50, ≤ 6.18.*
- ≥ 6.6.157, ≤ 6.6.*
- ≥ 7.2.4, ≤ 7.2.*
- 7.3-rc1
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
No data.
No data.
Red Hat Enterprise Linux 10
kernel
Fix deferred
Red Hat Enterprise Linux 10
kernel-rt
Fix deferred
Red Hat Enterprise Linux 6
kernel
Out of support scope
Red Hat Enterprise Linux 7
kernel
Fix deferred
Red Hat Enterprise Linux 7
kernel-rt
Fix deferred
Red Hat Enterprise Linux 8
kernel
Fix deferred
Red Hat Enterprise Linux 8
kernel-rt
Fix deferred
Red Hat Enterprise Linux 9
kernel
Fix deferred
Red Hat Enterprise Linux 9
kernel-rt
Fix deferred
Red Hat OpenShift Container Platform 4
openshift/ose-rhel-coreos-8
Fix deferred
Red Hat OpenShift Container Platform 4
openshift/ose-rhel-coreos-9
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | kernel-rt | Fix deferred | n/a |
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | kernel | Fix deferred | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (13)
- https://access.redhat.com/security/cve/CVE-2026-80964 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2532324 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-76287 Advisory
- https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80964.mbox
- https://git.kernel.org/stable/c/368c521503e38e9bcfcf04c053eb1f85d22391b2
- https://git.kernel.org/stable/c/3ee9cea821730805f232f1e4db0f95e7420477fc
- https://git.kernel.org/stable/c/40ee4224e2fe24c05b92e4d37476adb6e83f10e9
- https://git.kernel.org/stable/c/43f161c53279adac0517cf1c443e531e738b54ce
- https://git.kernel.org/stable/c/b65d5182ecd6b7a24a83d980a0d06e809ef876c5
- https://git.kernel.org/stable/c/f48c5f3b03afdb795e5f448a1d53d912d5b09f2e
- https://git.kernel.org/stable/c/ffefee7daf2362f534097422bb7f8894e798adfd
- https://nvd.nist.gov/vuln/detail/CVE-2026-80964
- https://www.cve.org/CVERecord?id=CVE-2026-80964
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
No data
GitHub
No data