CVE-2026-80972

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Check card index validity at probe aloop driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time...

UBUNTU-CVE-2026-80969

In the Linux kernel, the following vulnerability has been resolved: ALSA: mpu401: Check card index validity at probe mpu401 driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe...

UBUNTU-CVE-2026-80964

In the Linux kernel, the following vulnerability has been resolved: ALSA: virmidi: Check card index validity at probe virmidi driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe...

UBUNTU-CVE-2026-80972

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Check card index validity at probe aloop driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time...

UBUNTU-CVE-2026-80968

In the Linux kernel, the following vulnerability has been resolved: ALSA: mts64: Check card index validity at probe Although mts64 driver has a check of the given devptr-id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via sysfs. This may lead ...

UBUNTU-CVE-2026-80967

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcxhr: initialize mutexes before requesting threaded IRQ pcxhrprobe requests pcxhrthreadedirq before initializing mgr-lock, even though the threaded handler takes that mutex. Initialize the manager locks before...

UBUNTU-CVE-2026-80970

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: do not copy out an uninitialised init response fcpioctlinit allocates its response buffer with kmalloc and copies the whole buffer back to userspace: bufsize = init.step0respsize + init.step2respsize; void resp freekfr...

UBUNTU-CVE-2026-80965

In the Linux kernel, the following vulnerability has been resolved: ALSA: serial-u16550: Check card index validity at probe serial-u16550 driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the...

CVE-2026-80964

In the Linux kernel, the following vulnerability has been resolved: ALSA: virmidi: Check card index validity at probe virmidi driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe...

UBUNTU-CVE-2026-80973

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

UBUNTU-CVE-2026-80966

In the Linux kernel, the following vulnerability has been resolved: ALSA: portman2x4: Check card index validity at probe Although portman2x4 driver has a check of the given devptr-id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via sysfs. This...

CVE-2026-89736 usb: gadget: u_audio: Fix use-after-free on sound card disconnect

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uaudio: Fix use-after-free on sound card disconnect gaudiocleanup invokes sndcardfreewhenclosed to initiate sound card teardown and immediately frees the underlying struct snduacchip context. However,...

CVE-2026-89736

CVE-2026-89736 is a use-after-free (UAF) in the Linux kernel's USB audio gadget driver (u_audio). During sound card disconnection, g_audio_cleanup() frees the struct snd_uac_chip context immediately after snd_card_free_when_closed() returns, but ALSA control elements (kctls) may still be open in ...

CVE-2026-89736

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uaudio: Fix use-after-free on sound card disconnect gaudiocleanup invokes sndcardfreewhenclosed to initiate sound card teardown and immediately frees the underlying struct snduacchip context. However,...

CVE-2026-80972

This vulnerability affects the ALSA aloop driver in the Linux kernel . The driver blindly trusts the devptr->id value as a valid card index at probe time. While this is safe for devices created during module probe, if a device is bound manually via the sysfs interface , the index can be -1 ("n...

EUVD-2026-76295

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Check card index validity at probe aloop driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at the module probe time...

EUVD-2026-76296

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

CVE-2026-80973

CVE-2026-80973 affects the Linux kernel's ALSA snd_usb_6fire driver. In usb6fire_comm_receiver_handler(), a MIDI event length byte supplied by the USB device is used without bounding it or checking urb->actual_length. The receiver_buffer is a 64-byte allocation (2-byte header + 62 usable bytes...

CVE-2026-80973 ALSA: 6fire: bound the MIDI event length from the device

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

CVE-2026-80973 ALSA: 6fire: bound the MIDI event length from the device

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...