CVE-2026-80812

NameCVE-2026-80812
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ALSA: dummy: Check card index validity at probe snd_dummy_probe() blindly trusts that the given devptr->id value is within the proper card index range. It's OK for the devices the driver itself creates at the module probe time, but if the device is bound manually via sysfs interface, this could be -1 as "none", and this leads to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4777-1, DLA-4788-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)bookworm6.1.176-1vulnerable
bookworm (security)6.1.187-1fixed
trixie (security), trixie6.12.107-1fixed
forky7.2.6-1fixed
sid7.2.7-1fixed
linux-6.12 (PTS)bookworm (security)6.12.107-1~deb12u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsourcebookworm6.1.187-1DLA-4777-1
linuxsourcetrixie6.12.107-1
linuxsource(unstable)7.1.12-1
linux-6.12sourcebookworm6.12.107-1~deb12u1DLA-4788-1

Notes

https://git.kernel.org/linus/02442d5fe8ee365a084b055d4fa81a0c1abfc3fd (7.3-rc1)

Search for package or bug name: Reporting problems