ALSA: virtio: Validate control metadata from the device (CVE-2026-64490) | HOL Guard CVE

High · CVSS 8.4CVE-2026-64490

ALSA: virtio: Validate control metadata from the device

Answer in brief

CVE-2026-64490 records a High severity (CVSS 8.4) vulnerability in ALSA: virtio: Validate control metadata from the device. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Jul 25, 2026Updated Aug 17, 2026Source checked Sep 21, 2026First seen by HOL Aug 5, 2026Material review Aug 17, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 8.4
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 8.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=d6568e3de42dd971a1356f7ba581e6600d53f0a0 <3243563f99ef5d3949b934bd6390a5679405d0e1 \|\| >=d6568e3de42dd971a1356f7ba581e6600d53f0a0 <5da9742de22db0dbaa8d414214ab5e1bedde00f9 \|\| >=d6568e3de42dd971a1356f7ba581e6600d53f0a0 <21584672fd699abe1768241d6c501b2de6139b6a \|\| >=d6568e3de42dd971a1356f7ba581e6600d53f0a0 <c77a6cbb36ff8cbc1f084d94f8dcda5250935271	3243563f99ef5d3949b934bd6390a5679405d0e1, 5da9742de22db0dbaa8d414214ab5e1bedde00f9, 21584672fd699abe1768241d6c501b2de6139b6a, c77a6cbb36ff8cbc1f084d94f8dcda5250935271
Linux/Linuxgeneric	6.9	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 3243563f99ef5d3949b934bd6390a5679405d0e1 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Aug 5, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used directly to index g_v2a_type_map[] in virtsnd_kctl_info(), and to size loops and memcpy() operations in virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size virtio_snd_ctl_value and snd_ctl_elem_value arrays. A buggy or malicious device can therefore trigger out-of-bounds access by advertising an invalid control type or an oversized value count. Validate control type and count once in virtsnd_kctl_parse_cfg(), before querying enumerated items or exposing the control to ALSA.

Quoted source text, attributed separately from HOL analysis.