CVE-2026-80966

What it actually does

The Linux kernel ALSA driver for the Midiman Portman 2x4 parallel-port MIDI interface (snd-portman2x4) validates the device id on probe but does not reject a negative card index. A negative id—commonly supplied when the driver is bound through sysfs with a sentinel such as “none”—is then used to address kernel arrays (index[] and related per-card parameters), causing an out-of-bounds access in kernel space. That can produce a kernel oops or panic, corrupt adjacent kernel memory, or in principle be abused for local privilege escalation. The condition is reached only if this uncommon driver is loaded or bound; it is a local memory-corruption issue, not a remote one.

Why it matters to the business

Risk is low for most organizations. The issue was published about 20 days ago, has a very low and stable EPSS (0.0022, unchanged over 30 days), is not in CISA KEV, is not associated with ransomware, and has no known in-the-wild exploitation. Practical impact is limited to Linux hosts that actually load this niche parallel-port MIDI driver: possible kernel crash (availability) or local privilege escalation if untrusted users can bind drivers or set module parameters. Hosts that never load snd-portman2x4 are not exposed. Treat as routine kernel hygiene unless the driver is present on multi-tenant or untrusted-local-user systems.

How an attack unfolds

A local actor on a Linux system where the portman2x4 ALSA driver can be loaded or bound causes probe to run with a negative card index. The driver historically checked the id but not for values below zero, so that index is used against kernel parameter arrays. The resulting out-of-bounds access can crash the kernel or corrupt kernel memory. Converting that corruption into reliable privilege escalation would require additional local control of memory layout and is not known to be weaponized: exploit maturity is none, no public exploit is reported, and no named threat actors or campaigns are associated with this CVE.

How to fix it

Install the Linux distribution kernel update that includes the ALSA portman2x4 card-index validity check. Upstream rejects or corrects an out-of-range (including negative) id at probe and warns. Exact package versions were not supplied with this record, so use the vendor kernel changelog or CVE tracker for the fixed build. If a patch is not yet available, unload and blacklist snd-portman2x4 on systems that do not use a Portman 2x4 interface, restrict who can load modules or bind drivers via sysfs, and do not pass an invalid index parameter. Reboot into the patched kernel for the fix to take effect.

How to confirm the fix worked

Confirm the running kernel’s changelog or vendor CVE mapping includes the portman2x4 index sanity check, or that snd-portman2x4 is not loaded (lsmod, /sys/module) and is blacklisted if unused. After patching, an out-of-range card index should be rejected or corrected with a kernel warning rather than an out-of-bounds access. Most server and cloud kernels that never ship this parallel-port MIDI driver can be recorded as not applicable.

Typical attack path

1. Obtain local access on a Linux host that includes the ALSA portman2x4 driver
2. Arrange for the driver to probe or bind with a negative or otherwise out-of-range card index (typically via sysfs bind or module parameters)
3. Cause the probe path to use that index against index[] and related kernel parameter arrays
4. Induce an out-of-bounds kernel memory access, producing denial of service or memory corruption
5. Optionally attempt to turn that corruption into local privilege escalation; no public, reliable method is known

How to detect it

No public exploits or campaigns are known, so confirmed prior abuse is unlikely. Hunt for local actions that would have hit the unpatched probe path: kernel logs (dmesg, journalctl --dmesg, kern.log, syslog) for portman2x4 / snd-portman2x4 probe, oops, BUG, or panic around ALSA; audit records of module load (modprobe/insmod snd-portman2x4) and of writes to the driver’s sysfs bind/unbind nodes; unexpected presence of the module on hosts with no Portman hardware. On unpatched kernels the driver did not warn on a negative id, so lack of a warning does not prove the action never occurred. Correlate any oops in this driver with a preceding bind or module load.

• snd-portman2x4
• snd_portman2x4
• portman2x4
• ALSA: portman2x4
• /sys/module/snd_portman2x4
• modprobe snd-portman2x4
• insmod snd-portman2x4

What your security team should do

• Patch with the vendor kernel that contains the portman2x4 index check on any host that loads this driver; elsewhere fold into normal kernel maintenance (low EPSS, not KEV, no known exploitation).
• Inventory snd-portman2x4 / portman2x4 (loaded, built-in, or shipped); unload and blacklist where the hardware is not used.
• Limit unprivileged module load and sysfs driver bind/unbind (including CAP_SYS_MODULE).
• Watch for unexpected loads of this module and for kernel oopses in the portman2x4 probe path.
• No CISA KEV due date applies; track distribution advisories for exact fixed kernel package versions.