Cloudanix VulnDB

CVE-2026-80812

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux sound driver lets a local user feed bad data through a system interface, which can crash the machine or allow the user to gain higher privileges.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

The snd_dummy_probe function in the ALSA dummy driver accepts an arbitrary card index from devptr->id without validation when the device is bound manually through sysfs, allowing an out-of-bounds read or write into the index array and related driver parameters.

Why it matters to the business

Local users on Linux systems that load the snd-dummy module can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation with no remote attack surface.

How an attack unfolds

An attacker with local access creates or rebinds an ALSA dummy device node through the sysfs interface, supplying an id value of -1 or another out-of-range index; the probe routine then indexes into driver arrays using this invalid value, resulting in memory corruption.

How to fix it

Apply the upstream kernel commit that adds the card-index sanity check in snd_dummy_probe; rebuild and boot a patched kernel or update to a distribution release containing the fix.

How to confirm the fix worked

Confirm the presence of the index-range check in the snd_dummy_probe function source or verify that manual sysfs binding with an out-of-range id now produces a warning and corrected value instead of an out-of-bounds access.

Typical attack path

  1. Obtain local shell or user context on the target Linux system
  2. Locate the ALSA sysfs device binding interface for the snd-dummy driver
  3. Write an invalid card index value (such as -1) to the id attribute
  4. Trigger module probe or device binding to execute the unchecked index operation
  5. Leverage resulting memory corruption for denial of service or escalation

How to detect it

Review kernel logs for ALSA dummy probe warnings mentioning invalid card indices; inspect sysfs writes to ALSA device id attributes and correlate with subsequent oops or panic entries.

What your security team should do

  • Prioritize patching any systems that expose the ALSA sysfs interface to untrusted local users
  • Audit kernel configurations to determine whether the snd-dummy module is loaded by default
  • Monitor EPSS and KEV feeds for any future increase in exploit maturity

The record

In the Linux kernel, the following vulnerability has been resolved: ALSA: dummy: Check card index validity at probe snd_dummy_probe() blindly trusts that the given devptr->id value is within the proper card index range. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range.

Affected packages

Ecosystem Package Introduced Fixed