CVE-2026-64490
In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used directly to index g_v2a_type_map[] in virtsnd_kctl_info(), and to size loops and memcpy() operations in virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size virtio_snd_ctl_value and snd_ctl_elem_value arrays. A buggy or malicious device can therefore trigger out-of-bounds access by advertising an invalid control type or an oversized value count. Validate control type and count once in virtsnd_kctl_parse_cfg(), before querying enumerated items or exposing the control to ALSA.
Affected versions
Linux kernel versions
6.9
and later are affected. Fixed in
6.12.96,
6.18.39,
7.1.4,
7.2-rc1
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-64490?
CVE-2026-64490 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.9 onward and has been patched in 6.12.96, 6.18.39, 7.1.4 and others. CVE-2026-64490 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64490?
Yes. CVE-2026-64490 has been patched. Fixed versions include 6.12.96, 6.18.39, 7.1.4 and others. If you are running Linux kernel 6.9 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64490 actively exploited?
No. CVE-2026-64490 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.