{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64490", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.792Z", "datePublished": "2026-07-25T08:51:48.877Z", "dateUpdated": "2026-08-05T12:42:27.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:42:27.000Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: virtio: Validate control metadata from the device\n\nvirtio-snd control handling trusts the device-provided control type and\nvalue count returned by the device.\n\nThat metadata is then used directly to index g_v2a_type_map[] in\nvirtsnd_kctl_info(), and to size loops and memcpy() operations in\nvirtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size\nvirtio_snd_ctl_value and snd_ctl_elem_value arrays.\n\nA buggy or malicious device can therefore trigger out-of-bounds access by\nadvertising an invalid control type or an oversized value count.\n\nValidate control type and count once in virtsnd_kctl_parse_cfg(), before\nquerying enumerated items or exposing the control to ALSA."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The malformed metadata arrives through a locally attached virtio-snd device/backend and reaches vulnerable ALSA callbacks through local control operations. No routable network path or physical attachment is required.\nAC:L - The backend directly controls the type, count, access flags, and returned values, allowing deterministic oversized loops or copies without a race. Repeated control notifications and operations permit reliable triggering and heap grooming.\nPR:N - A malicious virtio backend supplies metadata during device initialization without guest authentication or capability checks. Standard OSS mixer registration or an automatically running audio service can subsequently access the control without the attacker holding guest credentials.\nUI:N - No human action is required because OSS mixer construction and normal audio-service enumeration can query or operate newly registered controls automatically. The backend can also generate control-change notifications to provoke further accesses.\nS:U - The vulnerable driver and corrupted kernel memory are within the same guest-kernel security authority. This is host-to-guest device exploitation, not a guest-to-host escape or IOMMU-boundary bypass.\nC:H - Oversized read operations copy data beyond the fixed 512-byte response into the userspace-returned ALSA value structure, exposing adjacent kernel heap contents. The unchecked type-map index also provides a device-selected out-of-bounds kernel read.\nI:H - Oversized INTEGER64, ENUMERATED, and BYTES write operations copy control values beyond the 512-byte virtio request payload into adjacent kernel heap objects. This controlled heap corruption can plausibly provide arbitrary modification or control-flow hijacking.\nA:H - Invalid type indices, enormous loops or memcpy lengths, and resulting heap corruption can cause an immediate kernel fault, oops, panic, or hang. The malicious backend can trigger the condition repeatedly."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/virtio/virtio_kctl.c"], "versions": [{"version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0", "lessThan": "3243563f99ef5d3949b934bd6390a5679405d0e1", "status": "affected", "versionType": "git"}, {"version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0", "lessThan": "5da9742de22db0dbaa8d414214ab5e1bedde00f9", "status": "affected", "versionType": "git"}, {"version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0", "lessThan": "21584672fd699abe1768241d6c501b2de6139b6a", "status": "affected", "versionType": "git"}, {"version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0", "lessThan": "c77a6cbb36ff8cbc1f084d94f8dcda5250935271", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/virtio/virtio_kctl.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.2-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3243563f99ef5d3949b934bd6390a5679405d0e1"}, {"url": "https://git.kernel.org/stable/c/5da9742de22db0dbaa8d414214ab5e1bedde00f9"}, {"url": "https://git.kernel.org/stable/c/21584672fd699abe1768241d6c501b2de6139b6a"}, {"url": "https://git.kernel.org/stable/c/c77a6cbb36ff8cbc1f084d94f8dcda5250935271"}], "title": "ALSA: virtio: Validate control metadata from the device", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/virtio/virtio_kctl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3243563f99ef5d3949b934bd6390a5679405d0e1", "status": "affected", "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0", "versionType": "git"}, {"lessThan": "5da9742de22db0dbaa8d414214ab5e1bedde00f9", "status": "affected", "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0", "versionType": "git"}, {"lessThan": "21584672fd699abe1768241d6c501b2de6139b6a", "status": "affected", "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0", "versionType": "git"}, {"lessThan": "c77a6cbb36ff8cbc1f084d94f8dcda5250935271", "status": "affected", "version": "d6568e3de42dd971a1356f7ba581e6600d53f0a0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/virtio/virtio_kctl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.96", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: virtio: Validate control metadata from the device\n\nvirtio-snd control handling trusts the device-provided control type and\nvalue count returned by the device.\n\nThat metadata is then used directly to index g_v2a_type_map[] in\nvirtsnd_kctl_info(), and to size loops and memcpy() operations in\nvirtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size\nvirtio_snd_ctl_value and snd_ctl_elem_value arrays.\n\nA buggy or malicious device can therefore trigger out-of-bounds access by\nadvertising an invalid control type or an oversized value count.\n\nValidate control type and count once in virtsnd_kctl_parse_cfg(), before\nquerying enumerated items or exposing the control to ALSA."}], "id": "CVE-2026-64490", "lastModified": "2026-07-27T05:16:54.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-25T10:17:34.807", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/21584672fd699abe1768241d6c501b2de6139b6a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3243563f99ef5d3949b934bd6390a5679405d0e1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5da9742de22db0dbaa8d414214ab5e1bedde00f9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c77a6cbb36ff8cbc1f084d94f8dcda5250935271"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: virtio: Validate control metadata from the device", "id": "2507277", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507277"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in the Linux kernel's ALSA virtio sound driver. A malicious or buggy virtio device can provide invalid control metadata, such as an unknown control type or an oversized value count. The driver's control handling trusts this unvalidated metadata, leading to out-of-bounds access when processing sound control information. This vulnerability could allow a malicious device to cause a denial of service or potentially other impacts on the system."], "name": "CVE-2026-64490", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64490\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64490\nhttps://lore.kernel.org/linux-cve-announce/2026072550-CVE-2026-64490-72f5@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d6568e3de42dd971a1356f7ba581e6600d53f0a0,3243563f99ef5d3949b934bd6390a5679405d0e1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d6568e3de42dd971a1356f7ba581e6600d53f0a0,5da9742de22db0dbaa8d414214ab5e1bedde00f9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d6568e3de42dd971a1356f7ba581e6600d53f0a0,21584672fd699abe1768241d6c501b2de6139b6a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d6568e3de42dd971a1356f7ba581e6600d53f0a0,c77a6cbb36ff8cbc1f084d94f8dcda5250935271)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.96,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.39,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.4,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-26T01:15:16.977461+00:00", "updated": "2026-08-05T00:30:05.842728+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}