CVE-2026-80972 ALSA: aloop: Check card index validity at probe

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Check card index validity at probe aloop driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time...

CVE-2026-80972

This vulnerability affects the ALSA aloop driver in the Linux kernel . The driver blindly trusts the devptr->id value as a valid card index at probe time. While this is safe for devices created during module probe, if a device is bound manually via the sysfs interface , the index can be -1 ("n...

CVE-2026-80973

CVE-2026-80973 affects the Linux kernel's ALSA snd_usb_6fire driver. In usb6fire_comm_receiver_handler(), a MIDI event length byte supplied by the USB device is used without bounding it or checking urb->actual_length. The receiver_buffer is a 64-byte allocation (2-byte header + 62 usable bytes...

CVE-2026-80973

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

CVE-2026-80972

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Check card index validity at probe aloop driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time...

CVE-2026-80973 ALSA: 6fire: bound the MIDI event length from the device

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

CVE-2026-80971

CVE-2026-80971 is a use-after-free vulnerability in the ALSA bcd2000 driver (snd_bcd2000) of the Linux kernel. On USB device disconnect, bcd2000_free_usb_related_resources() frees both MIDI URBs without clearing the pointers. A still-open rawmidi substream can then access the freed URBs via the t...

EUVD-2026-76294

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000freeusbrelatedresources frees both URBs and leaves the pointers behind: usbkillurbbcd2k-midiouturb; usbkillurbbcd2k-midiinurb; usbfreeurbbcd2k-midiouturb;...

CVE-2026-80971

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000freeusbrelatedresources frees both URBs and leaves the pointers behind: usbkillurbbcd2k-midiouturb; usbkillurbbcd2k-midiinurb; usbfreeurbbcd2k-midiouturb;...

CVE-2026-80971 ALSA: bcd2000: clear the URB pointers on disconnect

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000freeusbrelatedresources frees both URBs and leaves the pointers behind: usbkillurbbcd2k-midiouturb; usbkillurbbcd2k-midiinurb; usbfreeurbbcd2k-midiouturb;...

CVE-2026-80970 ALSA: FCP: do not copy out an uninitialised init response

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: do not copy out an uninitialised init response fcpioctlinit allocates its response buffer with kmalloc and copies the whole buffer back to userspace: bufsize = init.step0respsize + init.step2respsize; void resp freekfr...

EUVD-2026-76292

In the Linux kernel, the following vulnerability has been resolved: ALSA: mpu401: Check card index validity at probe mpu401 driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe...

CVE-2026-80970 ALSA: FCP: do not copy out an uninitialised init response

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: do not copy out an uninitialised init response fcpioctlinit allocates its response buffer with kmalloc and copies the whole buffer back to userspace: bufsize = init.step0respsize + init.step2respsize; void resp freekfr...

CVE-2026-80969

In the Linux kernel, the following vulnerability has been resolved: ALSA: mpu401: Check card index validity at probe mpu401 driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe...

CVE-2026-80969 ALSA: mpu401: Check card index validity at probe

In the Linux kernel, the following vulnerability has been resolved: ALSA: mpu401: Check card index validity at probe mpu401 driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe...

EUVD-2026-76293

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: do not copy out an uninitialised init response fcpioctlinit allocates its response buffer with kmalloc and copies the whole buffer back to userspace: bufsize = init.step0respsize + init.step2respsize; void resp freekfr...

CVE-2026-80969

CVE-2026-80969 affects the Linux kernel 's ALSA mpu401 driver. At probe time, the driver blindly trusts the devptr->id value as a valid card index. While this is safe for devices created during normal module probe, if a device is bound manually via sysfs , the value can be -1 ("none"), leading...

CVE-2026-80970

CVE-2026-80970 affects the Linux kernel ALSA FCP USB audio driver. In fcp_ioctl_init(), the response buffer is allocated via kmalloc() without being zeroed. Because the step-0 USB control transfer does not set URB_SHORT_NOT_OK, a short or zero-length data stage is accepted as success, and snd_usb...

CVE-2026-80970

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: do not copy out an uninitialised init response fcpioctlinit allocates its response buffer with kmalloc and copies the whole buffer back to userspace: bufsize = init.step0respsize + init.step2respsize; void resp freekfr...

CVE-2026-80969 ALSA: mpu401: Check card index validity at probe

In the Linux kernel, the following vulnerability has been resolved: ALSA: mpu401: Check card index validity at probe mpu401 driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe...