CVE-2026-80965: Linux Kernel ALSA Privilege Escalation

CVE-2026-80965 Overview

CVE-2026-80965 is a Linux kernel vulnerability in the Advanced Linux Sound Architecture (ALSA) serial-u16550 driver. The driver blindly trusts that the devptr->id value falls within the valid card index range during probe. When the device is bound manually through the sysfs interface, this value can be -1 (representing "none"), which triggers out-of-bounds access on the index[] array and other driver parameters. The kernel maintainers resolved the issue by adding a sanity check that warns and corrects the card index when it falls outside the valid range.

Critical Impact
Local users with sysfs write access can trigger out-of-bounds memory access in the kernel, potentially leading to memory corruption or denial of service.

Affected Products

Linux kernel (mainline and stable trees containing the ALSA serial-u16550 driver)
Distributions shipping kernels prior to the fix commits referenced below
Systems exposing sysfs bind/unbind interfaces to privileged users

Discovery Timeline

2026-09-11 - CVE-2026-80965 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80965

Vulnerability Analysis

The serial-u16550 driver implements ALSA support for MIDI over 16550-compatible UARTs. During probe, the driver reads devptr->id and uses it directly as an index into internal arrays such as index[], id[], and enable[]. For devices the driver creates itself at module load time, the identifier is always valid. However, sysfs manual binding allows userspace to attach the driver to a platform device with id = -1, meaning the identifier is unassigned.

When the driver dereferences index[-1], it reads memory located before the array base, producing an out-of-bounds read [CWE-125]. Depending on kernel configuration and memory layout, this can leak adjacent data, corrupt driver state, or trigger a kernel oops. The vulnerability is classified as a kernel driver flaw affecting local attack surface.

Root Cause

The root cause is missing input validation on the platform device identifier before it is used as an array index. The driver assumes probe callers supply a bounded value, but the sysfs bind path does not enforce this invariant. The kernel patches add an explicit range check and clamp the identifier to a valid slot, emitting a warning when correction occurs.

Attack Vector

Exploitation requires local access with permission to write to /sys/bus/platform/drivers/snd-serial-u16550/bind or equivalent driver-binding interfaces. These paths are typically restricted to root, so the practical attack surface is limited to privileged users, containers with device access, or environments where sysfs permissions have been relaxed. Successful exploitation results in out-of-bounds memory access at driver probe time.

No public proof-of-concept exploit is available. See the kernel patch series for the full technical fix.

Detection Methods for CVE-2026-80965

Indicators of Compromise

Kernel log entries referencing serial-u16550 probe failures, out-of-range card index warnings, or unexpected driver oops messages
Unusual writes to /sys/bus/platform/drivers/snd-serial-u16550/bind by non-administrative processes
Unexpected loading of the snd-serial-u16550 module on systems that do not use serial MIDI hardware

Detection Strategies

Audit sysfs bind and unbind operations through the Linux audit subsystem to identify manual driver binding attempts
Monitor kernel ring buffer (dmesg) for warnings introduced by the patch when an out-of-range card index is corrected
Compare running kernel versions and module builds against distribution advisories to identify unpatched hosts

Monitoring Recommendations

Forward auditd and kernel log telemetry to a centralized analytics platform to correlate driver bind activity with process context
Alert on module loads for snd-serial-u16550 outside of expected inventory
Track privileged writes to /sys/bus/platform/drivers/*/bind across the fleet to baseline legitimate driver management activity

How to Mitigate CVE-2026-80965

Immediate Actions Required

Apply the upstream Linux kernel patches or vendor-provided kernel updates that include the card index validation fix
Restrict access to sysfs driver bind and unbind interfaces to trusted administrative accounts only
Blacklist the snd-serial-u16550 module on systems that do not require serial MIDI functionality

Patch Information

The fix is distributed across multiple stable branches. Reference commits include Kernel Patch 1cb30691, Kernel Patch 41a95230, Kernel Patch 487ede9b, Kernel Patch 6d6fdb24, Kernel Patch 7555e83d, Kernel Patch cc0f757d, Kernel Patch e0fb960b, and Kernel Patch fbf3fb09. Deploy the kernel package supplied by your distribution once it incorporates these commits.

Workarounds

Add snd-serial-u16550 to /etc/modprobe.d/blacklist.conf if the driver is not required for hardware operation
Ensure only privileged administrators can write to platform driver bind files by preserving default sysfs permissions
Disable manual module loading for unprivileged accounts using modules_disabled or comparable kernel hardening controls

bash

# Configuration example
echo 'blacklist snd-serial-u16550' | sudo tee /etc/modprobe.d/disable-serial-u16550.conf
sudo depmod -a
sudo update-initramfs -u