CVE-2026-68580

FreeRDP contains an integer overflow in the audio input redirection channel (audin) for versions before 3.29.0, affecting ALSA, sndio, WinMM, and OpenSL ES backends. A malicious FramesPerPacket value from the RDP server can cause allocation size wraparound, leading to a heap-based buffer overflow...

ALSA: gus: check snd_ctl_new1() return value

...

ALSA: usb-audio: avoid kobject path lookup in DualSense match

...

CVE-2026-64487

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser sndusbcaiaqtks4dispatch decodes the Traktor Kontrol S4 input stream in fixed 16-byte TKS4MSGBLOCKSIZE message blocks. On every iteration it advances buf a...

CVE-2026-64485

In the Linux kernel, the following vulnerability has been resolved: ALSA: compress: Fix task creation error unwind sndcomprtasknew allocates the driver task before validating the returned DMA buffers and reserving file descriptors. When either of those later steps fails, the core frees its task...

EUVD-2026-48825

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41hda creates ALSA controls whose private data points at the cs35l41hda object. The firmware load control can also queue fwloadwork. Those controls are not removed on...

CVE-2026-64481

The CVE-2026-64481 vulnerability affects the Linux kernel ALSA subsystem for the cs35l41 HDA driver. The issue arises because ALSA controls created by cs35l41_hda can reference the cs35l41_hda object and queue firmware load work (fw_load_work). If the component/device is unbound or removed before...

CVE-2026-53350

In the Linux kernel, the following vulnerability has been resolved: ASoC: wmadsp: Fix NULL dereference when removing firmware controls In wmadspcontrolremove check that the priv pointer is not NULL before attempting to cleanup what it points to. When csdsp creates a control it calls...

ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

...

ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()

...

CVE-2026-46048

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix usbdev refcount leak on probe failure createcard takes a reference on the USB device with usbgetdev and stores the matching usbputdev in cardfree, which is installed as the sndcard's -privatefree destructor...

kernel: ALSA: aloop: Fix racy access at PCM trigger

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop operations are...

CVE-2026-43126 ALSA: mixer: oss: Add card disconnect checkpoints

In the Linux kernel, the following vulnerability has been resolved: ALSA: mixer: oss: Add card disconnect checkpoints ALSA OSS mixer layer calls the kcontrol ops rather individually, and pending calls might be not always caught at disconnecting the device. For avoiding the potential UAF scenarios...

PT-2026-37466

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the ALSA OSS mixer layer. The mixer layer calls kcontrol operations individually, which may result in pending calls not being caught when a device is...

CVE-2026-31775

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization The recent refactoring of xfi driver changed the assignment of atc-daios at atcgetresources; now it loops over all enum DAIOTYP entries while it looped formerly only a pa...

CVE-2026-31581

CVE-2026-31581 affects the Linux kernel ALSA 6fire USB audio driver. The issue is a use-after-free in usb6fire_chip_abort() where the chip structure is allocated as the card’s private data and, after snd_card_free_when_closed() frees the card (when no file handles are open), a later write to chip...

CVE-2026-31581 ALSA: 6fire: fix use-after-free on disconnect

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6firechipabort, the chip struct is allocated as the card's private data via sndcardnew with sizeofstruct sfirechip. When sndcardfreewhenclosed is called and no file handles are...

The vulnerability of the topology_name_read() function in the sound/soc/intel/avs/pcm.c module of the Linux operating system’s SoC audio support module allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the topologynameread function in the sound/soc/intel/avs/pcm.c file, which is part of the Linux operating system’s audio support for SoC cores, stems from the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this...

kernel: ALSA: aloop: Fix racy access at PCM trigger

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop operations are...

The vulnerability of the sma1307 Setting_Loaded() function in the sound/soc/codecs/sma1307.c module of the Linux operating system’s SoC audio support module allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sma1307settingloaded function in the sound/soc/codecs/sma1307.c module, which is part of the Linux operating system’s audio support for SoC cores, relates to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a malicious...