CVE-2026-64133: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64133 Overview

CVE-2026-64133 is an out-of-bounds (OOB) array access vulnerability in the Linux kernel's ALSA (Advanced Linux Sound Architecture) asihpi driver. The flaw resides in the find_control() function, which retrieves cached control information by indexing into an array without validating the supplied index. A local authenticated attacker can trigger the OOB access to compromise kernel confidentiality, integrity, and availability. The upstream fix adds a sanity check on the index before array access. The issue was published to the NVD on 2026-07-19 and last modified on 2026-07-20.

Critical Impact
Local privileged access to systems running affected Linux kernels with the snd-asihpi driver loaded can lead to kernel memory corruption, information disclosure, or denial of service through out-of-bounds array indexing in find_control().

Affected Products

Linux kernel versions containing the sound/pci/asihpi driver prior to the upstream fix
Distributions shipping the snd-asihpi kernel module
Systems with AudioScience HPI hardware or driver loaded

Discovery Timeline

2026-07-19 - CVE-2026-64133 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64133

Vulnerability Analysis

The vulnerability exists in the ALSA asihpi driver used to support AudioScience HPI sound hardware on Linux. The find_control() helper function is responsible for locating a cached control descriptor by index. The function accesses the underlying array using the caller-supplied index without verifying that the value falls within the allocated bounds. When a larger-than-expected index is passed in, the function dereferences memory outside the intended cache array, resulting in an out-of-bounds read.

OOB access in kernel space can leak adjacent kernel memory contents, corrupt neighboring data structures if the read result is used in subsequent write paths, or crash the kernel through invalid pointer dereferences. The upstream commits add an explicit sanity check on the index against the array size before the access is performed. This is classified as an Out-of-Bounds Read [CWE-125] issue in kernel driver code.

Root Cause

The root cause is missing input validation on an array index inside find_control(). The function trusted the index value supplied through the control lookup path, assuming callers would only pass valid entries. When cache metadata or userspace-influenced state supplies an unexpected index, the missing bounds check permits reads beyond the array's allocated length.

Attack Vector

Exploitation requires local access with the ability to interact with the ALSA control interface exposed by the snd-asihpi driver. An attacker with permission to open the device node and issue control ioctls can influence the index used by find_control(). Because the attack vector is local and requires low-privileged access, remote exploitation is not possible. Successful exploitation can produce kernel information disclosure or a denial-of-service condition, and under specific conditions may facilitate further memory corruption chains.

No verified public proof-of-concept code is available. Refer to the upstream commits (Kernel Git Commit Fix and Kernel Git Commit Patch) for the exact code paths and the sanity check that resolves the issue.

Detection Methods for CVE-2026-64133

Indicators of Compromise

Unexpected kernel oops or panic messages referencing snd_asihpi or find_control in dmesg or /var/log/kern.log.
KASAN (Kernel Address Sanitizer) reports of out-of-bounds reads originating in the asihpi module.
Unprivileged processes issuing an unusually high volume of ALSA control ioctls against /dev/snd/controlC* nodes tied to AudioScience HPI devices.

Detection Strategies

Enable KASAN on test and staging systems running the snd-asihpi driver to surface the OOB read at runtime.
Audit loaded kernel modules across the fleet with lsmod | grep asihpi and cross-reference against patched kernel versions.
Monitor for kernel crash telemetry that references ALSA control paths, correlating with users or services accessing sound device nodes.

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized log store and alert on asihpi-related stack traces.
Track kernel version and module inventory changes across Linux endpoints to confirm patched builds are deployed.
Baseline expected access patterns to /dev/snd/* and alert on new processes exercising control interfaces on affected hardware.

How to Mitigate CVE-2026-64133

Immediate Actions Required

Update to a Linux kernel build that includes the upstream sanity check fix for find_control() in sound/pci/asihpi.
On systems that do not require AudioScience HPI hardware, blacklist or unload the snd-asihpi module to remove the vulnerable code path.
Restrict access to ALSA device nodes so only trusted users and services can issue control ioctls.

Patch Information

The fix is available in multiple upstream stable branches. See the relevant commits: Kernel Git Commit Update, Kernel Git Commit Fix, Kernel Git Commit Improvement, Kernel Git Commit Change, Kernel Git Commit Security, Kernel Git Commit Refactor, Kernel Git Commit Patch, and Kernel Git Commit Enhancement. Apply vendor-provided kernel updates from your Linux distribution as they become available.

Workarounds

Blacklist the snd-asihpi module on hosts that do not use AudioScience HPI audio hardware.
Tighten permissions on /dev/snd/* nodes so untrusted local users cannot invoke ALSA control operations against the affected driver.
Limit the set of users permitted in the audio group on multi-user systems until the patched kernel is deployed.

bash

# Blacklist the vulnerable module until the kernel is patched
echo "blacklist snd_asihpi" | sudo tee /etc/modprobe.d/blacklist-asihpi.conf
sudo modprobe -r snd_asihpi 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep asihpi

# Confirm running kernel version to validate patch deployment
uname -r