CVE-2026-80964: Linux Kernel ALSA Privilege Escalation Flaw

CVE-2026-80964 is a privilege escalation vulnerability in the Linux kernel ALSA virmidi driver caused by insufficient card index validation. This flaw enables out-of-bounds memory access through manual device binding. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-80964 Overview

CVE-2026-80964 affects the Linux kernel's Advanced Linux Sound Architecture (ALSA) virtual MIDI (virmidi) driver. The driver trusts the devptr->id card index value at probe without validating its range. When a device is bound manually through the sysfs interface, this identifier can be -1 (representing "none"), leading to out-of-bounds access into the index[] array and related driver parameters. The upstream fix adds a sanity check that warns and corrects the card index if it falls outside the valid range.

Critical Impact
A local user with the ability to bind the virmidi driver via sysfs can trigger an out-of-bounds memory access in the Linux kernel, potentially resulting in kernel memory corruption or denial of service.

Affected Products

Linux kernel — ALSA virmidi driver
Multiple stable kernel branches receiving backports (see kernel.org stable tree commits)
Systems permitting manual driver binding through /sys/bus/*/drivers/*/bind

Discovery Timeline

2026-09-11 - CVE-2026-80964 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80964

Vulnerability Analysis

The ALSA virmidi driver provides virtual raw MIDI devices backed by an ALSA sequencer. During probe, the driver reads devptr->id to index module parameter arrays such as index[] and midi_devs[]. When the driver instantiates devices at module load, devptr->id is guaranteed to lie within the configured range. However, an administrative user can bind an arbitrary platform device to the driver through sysfs, and in that path devptr->id may equal -1 to indicate that no fixed card slot was assigned.

Using -1 as an array index produces an out-of-bounds read against kernel arrays sized by SNDRV_CARDS. Depending on the surrounding memory layout, this can leak adjacent kernel data, corrupt neighboring structures, or cause a kernel oops when subsequent code paths dereference the invalid entry. The fix validates the index at probe and clamps or rejects the request when the value falls outside [0, SNDRV_CARDS).

Root Cause

The root cause is missing input validation on an externally influenced index value. The virmidi probe routine dereferenced devptr->id without confirming that the identifier represented a valid ALSA card slot, violating standard defensive programming practices for kernel driver probe handlers.

Attack Vector

Exploitation requires local access with sufficient privileges to write to the driver's sysfs bind attribute, which typically means root or a process with CAP_SYS_ADMIN. This limits practical impact but remains relevant in multi-tenant, container, or sandbox scenarios where kernel memory corruption can be chained with other primitives to escalate privileges or crash the host.

No verified public proof-of-concept is available.
See the upstream kernel commits for the corrective patch:
- git.kernel.org/stable/c/368c521503e38e9bcfcf04c053eb1f85d22391b2
- git.kernel.org/stable/c/3ee9cea821730805f232f1e4db0f95e7420477fc
- git.kernel.org/stable/c/40ee4224e2fe24c05b92e4d37476adb6e83f10e9

Detection Methods for CVE-2026-80964

Indicators of Compromise

Kernel log entries containing warnings from the newly added virmidi card-index sanity check.
Unexpected oops, BUG, or KASAN reports referencing snd_virmidi symbols during driver binding.
Writes to /sys/bus/platform/drivers/snd-virmidi/bind originating from non-standard user sessions.

Detection Strategies

Audit auditd or eBPF telemetry for openat and write operations targeting driver bind and unbind sysfs attributes.
Correlate kernel ring buffer messages (dmesg) with process ancestry to identify who triggered virmidi probe events.
Compare installed kernel package versions against distribution advisories referencing the virmidi fix commits.

Monitoring Recommendations

Forward kernel logs to a centralized analytics platform and alert on ALSA subsystem warnings tied to virmidi.
Baseline expected loaders of snd_virmidi on production systems; treat manual sysfs binds as high-signal events.
Track kernel package inventory across the fleet to confirm patched builds are deployed.

How to Mitigate CVE-2026-80964

Immediate Actions Required

Upgrade the Linux kernel to a stable release that includes the virmidi card-index validation patch listed in the kernel.org references.
Restrict access to driver bind and unbind sysfs entries to trusted administrators only.
If virmidi is not required, blacklist the snd_virmidi module to eliminate exposure.

Patch Information

The upstream fix adds range validation for devptr->id in the virmidi probe function and warns or corrects the value when out of range. Corrective commits are available in the mainline and stable trees, including 368c5215, 3ee9cea8, 40ee4224, 43f161c5, b65d5182, f48c5f3b, and ffefee7d. Apply the vendor kernel update matching your distribution.

Workarounds

Blacklist the snd_virmidi module where virtual MIDI functionality is not needed.
Tighten permissions on /sys/bus/platform/drivers/snd-virmidi/ so only privileged administrators can write bind.
Use kernel lockdown or module signing policies to prevent unauthorized module loading in hardened environments.

bash

# Blacklist the virmidi module until a patched kernel is deployed
echo "blacklist snd_virmidi" | sudo tee /etc/modprobe.d/blacklist-virmidi.conf
sudo depmod -a
sudo update-initramfs -u   # Debian/Ubuntu; use dracut on RHEL-family systems

# Verify the module is not loaded after reboot
lsmod | grep snd_virmidi