CVE-2026-74640: Linux Kernel ALSA FCP Buffer Overflow

CVE-2026-74640 Overview

CVE-2026-74640 is an out-of-bounds write vulnerability in the Linux kernel's ALSA Focusrite Control Protocol (FCP) driver. The flaw resides in fcp_meter_ctl_get(), which stores 64-bit words into the snd_ctl_elem_value.value.integer.value[] array without bounding writes against that array's fixed length of 128 elements. An oversized Level Meter map installed through fcp_ioctl_set_meter_map() allows channel counts up to 255, causing writes to overflow the slab allocation by up to 888 bytes and corrupt adjacent kernel objects. Any local user with read access to /dev/snd/controlC0 can trigger the OOB write once an oversized map has been installed.

Critical Impact
A local unprivileged process can trigger controlled slab-out-of-bounds writes in the Linux kernel, enabling memory corruption and potential local privilege escalation.

Affected Products

Linux kernel ALSA FCP driver (Focusrite Control Protocol)
Kernel builds affected as observed on 7.2.0-rc5 (arm64) with KASAN
Systems exposing /dev/snd/controlC0 with the FCP driver loaded

Discovery Timeline

2026-08-22 - CVE-2026-74640 published to NVD
2026-08-25 - Last updated in NVD database
Vulnerability discovered by XBOW and triaged by Baul Lee

Technical Details for CVE-2026-74640

Vulnerability Analysis

The Linux kernel's ALSA FCP driver exposes an ioctl, fcp_ioctl_set_meter_map(), that accepts a user-supplied Level Meter map. The driver validates map.map_size against its own upper bound of 255 and passes that value to fcp_add_new_ctl() as the control's channel count, where it is stored in elem->channels.

Every control read populates struct snd_ctl_elem_value, whose backing integer array is declared as long value[128]. The real ABI limit is therefore 128 elements, not 255. Inside fcp_meter_ctl_get(), the driver iterates from 0 to elem->channels and writes one 64-bit word per channel into that array with no sink-side bounds check.

snd_ctl_elem_read_user() allocates the object via memdup_user() at 1224 bytes from the kmalloc-2048 cache. With offsetof(struct snd_ctl_elem_value, value) equal to 72, element i lands at byte 72 + 8 * i. Element 144 already exceeds the allocation, and at map_size 255 the final store reaches byte 2112, 888 bytes past the object and 64 bytes into the adjacent slab object.

The attacker controls both the write extent through the map size and the written contents through meter_level_map[], which selects which device-supplied word lands in which slot. snd_ctl_check_elem_info() does not catch the mismatch because it is only invoked under CONFIG_SND_CTL_DEBUG, and __snd_ctl_add_replace() validates kcontrol->count without inspecting elem->channels.

Root Cause

The root cause is a mismatch between the driver's internal channel-count limit (255) and the ALSA control ABI's fixed value array size (128 long entries). The driver treats the wider limit as authoritative and performs writes without checking the destination array bound, producing a classic sink-side missing bounds check [CWE-787].

Attack Vector

Installing an oversized map requires CAP_SYS_RAWIO, but the resulting control object outlives the hwdep descriptor that created it. After installation, any local process able to read controls on /dev/snd/controlC0 triggers the out-of-bounds writes on each control read. The vulnerability requires local access with low privileges to reach the vulnerable path.

The vulnerability was confirmed by KASAN on kernel 7.2.0-rc5 (arm64), reporting a slab-out-of-bounds write of size 8 at an address 0 bytes to the right of a 1224-byte allocation. See the kernel commit fixing this issue for details of the corrected bounds logic.

Detection Methods for CVE-2026-74640

Indicators of Compromise

KASAN reports of slab-out-of-bounds writes in fcp_meter_ctl_get originating from snd_ctl_elem_read and snd_ctl_ioctl call chains.
Unexpected kernel oops, panic, or general protection fault events referencing ALSA control paths on hosts with Focusrite audio hardware or the FCP driver loaded.
Non-audio workloads issuing ioctls against /dev/snd/controlC0, particularly SNDRV_CTL_IOCTL_ELEM_READ from unexpected processes.

Detection Strategies

Audit processes holding CAP_SYS_RAWIO that interact with ALSA hwdep or control device nodes, as this capability is required to install the oversized map.
Enable KASAN or KFENCE on test and canary systems to catch out-of-bounds writes in ALSA paths before they propagate.
Alert on kernel log entries containing KASAN, BUG, or slab-out-of-bounds combined with fcp_meter_ctl_get or snd_ctl_.

Monitoring Recommendations

Collect and centralize dmesg and kern.log output to detect kernel memory-safety warnings across the fleet.
Monitor loading of the FCP kernel module on hosts that do not require Focusrite audio hardware, and flag it as anomalous.
Track access patterns to /dev/snd/controlC* device nodes, especially from unprivileged non-audio processes.

How to Mitigate CVE-2026-74640

Immediate Actions Required

Apply the upstream kernel patches referenced by the fix commits and reboot affected hosts.
Restrict CAP_SYS_RAWIO to the minimum set of processes required, since this capability is a prerequisite for installing the malformed map.
On systems without Focusrite audio hardware, blacklist the FCP driver module to remove the attack surface entirely.

Patch Information

The fix bounds the map size by the ALSA ABI limit rather than by the driver-local value of 255, and adds a sink-side bound in the store loop so it cannot iterate past the value[] array regardless of elem->channels. Patches are available in the following commits: 620f1e52a46f, bb30e35c36ed, and bb61dc2ae590.

Workarounds

Unload or blacklist the FCP driver on servers and workstations that do not use Focusrite audio interfaces.
Tighten permissions on /dev/snd/controlC* to trusted groups only, reducing the population of users able to trigger the vulnerable read path.
Remove CAP_SYS_RAWIO from container and service profiles that do not require raw device access.

bash

# Blacklist the FCP driver until patches are deployed
echo 'blacklist snd_fcp' | sudo tee /etc/modprobe.d/blacklist-fcp.conf
sudo update-initramfs -u

# Restrict access to ALSA control device nodes
sudo chgrp audio /dev/snd/controlC*
sudo chmod 0660 /dev/snd/controlC*