CVE-2026-80964

What it actually does

The ALSA virmidi (snd-virmidi) driver does not validate the sound-card index supplied at probe. When a device is bound manually and the index is out of range (for example -1 meaning "none"), the probe path indexes kernel arrays such as index[] and related module parameters, causing an out-of-bounds memory access and potential kernel memory corruption.

Why it matters to the business

A local actor who can bind this driver can crash or destabilize Linux hosts that load virtual MIDI, causing outages of audio and, in worst cases, the whole system. Practical risk is low: the issue is not in KEV, has no known exploit maturity, is not tied to ransomware or named threat actors, and EPSS remains about 0.002 with no 30-day increase. Exposure is limited to systems that use or can load snd-virmidi; there is no evidence of broad downstream package impact.

How an attack unfolds

An attacker with local access and enough privilege to bind kernel drivers through sysfs attaches the virmidi driver with an invalid card index. Probe trusts that index and performs out-of-bounds reads or writes against kernel parameter arrays. Binding already requires elevated rights, so the realistic outcomes are a kernel oops/panic (denial of service) or uncontrolled memory corruption rather than a reliable unprivileged remote compromise. No public exploit activity, KEV listing, or named APT/campaign use is associated with this defect.

How to fix it

Apply the upstream Linux kernel fix that sanity-checks the virmidi card index at probe and warns/corrects out-of-range values. Deploy vendor or distribution kernel updates that include the ALSA virmidi probe check. If virtual MIDI is not required, unload and blacklist snd-virmidi. Limit who can bind drivers through sysfs. No specific package version pins were provided; use distro CVE-to-kernel mappings for the exact fixed build.

How to confirm the fix worked

Confirm the running kernel changelog or distro advisory includes the virmidi card-index validity check at probe. Verify snd-virmidi is either patched or not loaded (lsmod / module inventory). On a patched kernel, an invalid index should produce a warning and a corrected value rather than an oops. Compare kernel package version against the distributor’s fixed kernel for this ALSA change.

Typical attack path

1. Obtain local access on a Linux host where the ALSA virtual MIDI driver can be loaded
2. Obtain privilege sufficient to bind drivers via sysfs
3. Bind virmidi with an out-of-range card index (such as the "none" / -1 case)
4. Trigger probe so the driver uses that index against kernel arrays without bounds checks
5. Cause out-of-bounds kernel memory access, typically a crash or unstable kernel behavior

How to detect it

This is a local probe-time kernel defect with no public exploitation, so widespread compromise is unlikely. Hunt kernel logs (dmesg, journal, persistent oops/panic collectors) for snd-virmidi / virmidi probe, out-of-range card index warnings, and stack traces in the ALSA virmidi path. Correlate with sysfs driver bind/unbind around the virmidi driver and with loads of snd-virmidi. Review audit or file-integrity logs for writes to driver bind interfaces. Absence of oopses does not prove the module was never bound incorrectly; presence of a virmidi-related oops after a manual bind is the strongest post-exploitation artifact.

• snd-virmidi
• snd_virmidi
• virmidi
• Oops:.*virmidi
• BUG:.*virmidi
• invalid card index
• snd-virmidi.ko
• module snd_virmidi
• /sys/module/snd_virmidi/
• drivers/virmidi/bind
• sound/drivers/dummy.c
• ALSA: virmidi

What your security team should do

• Treat as a low-urgency local kernel memory-safety issue: not KEV, EPSS ~0.002 and flat, exploit maturity none, published ~20 days ago
• Patch Linux kernels through normal distro security updates that include the ALSA virmidi probe bounds check
• Inventory hosts that load snd-virmidi or expose ALSA virtual MIDI and prioritize those if they allow sysfs driver bind
• Unload and blacklist snd-virmidi where virtual MIDI is unused
• Restrict sysfs driver bind/unbind to trusted administrators
• Watch kernel logs for virmidi probe warnings, oopses, or panics after bind events