Answer in brief
CVE-2026-64490 records a Unknown severity vulnerability in ALSA: virtio: Validate control metadata from the device. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d6568e3de42dd971a1356f7ba581e6600d53f0a0 <3243563f99ef5d3949b934bd6390a5679405d0e1 || >=d6568e3de42dd971a1356f7ba581e6600d53f0a0 <5da9742de22db0dbaa8d414214ab5e1bedde00f9 || >=d6568e3de42dd971a1356f7ba581e6600d53f0a0 <21584672fd699abe1768241d6c501b2de6139b6a || >=d6568e3de42dd971a1356f7ba581e6600d53f0a0 <c77a6cbb36ff8cbc1f084d94f8dcda5250935271 | 3243563f99ef5d3949b934bd6390a5679405d0e1, 5da9742de22db0dbaa8d414214ab5e1bedde00f9, 21584672fd699abe1768241d6c501b2de6139b6a, c77a6cbb36ff8cbc1f084d94f8dcda5250935271 |
| Linux/Linuxgeneric | 6.9 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used directly to index g_v2a_type_map[] in virtsnd_kctl_info(), and to size loops and memcpy() operations in virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size virtio_snd_ctl_value and snd_ctl_elem_value arrays. A buggy or malicious device can therefore trigger out-of-bounds access by advertising an invalid control type or an oversized value count. Validate control type and count once in virtsnd_kctl_parse_cfg(), before querying enumerated items or exposing the control to ALSA.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-64490 records a Unknown severity vulnerability in ALSA: virtio: Validate control metadata from the device. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d6568e3de42dd971a1356f7ba581e6600d53f0a0 <3243563f99ef5d3949b934bd6390a5679405d0e1 || >=d6568e3de42dd971a1356f7ba581e6600d53f0a0 <5da9742de22db0dbaa8d414214ab5e1bedde00f9 || >=d6568e3de42dd971a1356f7ba581e6600d53f0a0 <21584672fd699abe1768241d6c501b2de6139b6a || >=d6568e3de42dd971a1356f7ba581e6600d53f0a0 <c77a6cbb36ff8cbc1f084d94f8dcda5250935271 | 3243563f99ef5d3949b934bd6390a5679405d0e1, 5da9742de22db0dbaa8d414214ab5e1bedde00f9, 21584672fd699abe1768241d6c501b2de6139b6a, c77a6cbb36ff8cbc1f084d94f8dcda5250935271 |
| Linux/Linuxgeneric | 6.9 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used directly to index g_v2a_type_map[] in virtsnd_kctl_info(), and to size loops and memcpy() operations in virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size virtio_snd_ctl_value and snd_ctl_elem_value arrays. A buggy or malicious device can therefore trigger out-of-bounds access by advertising an invalid control type or an oversized value count. Validate control type and count once in virtsnd_kctl_parse_cfg(), before querying enumerated items or exposing the control to ALSA.
Quoted source text, attributed separately from HOL analysis.