CVE-2026-80966: Linux Kernel ALSA portman2x4 OOB Vulnerability

CVE-2026-80966 Overview

CVE-2026-80966 affects the Linux kernel's Advanced Linux Sound Architecture (ALSA) portman2x4 driver. The driver validates the devptr->id value at probe time but fails to check for negative identifiers. When the device is bound via sysfs with a value such as none, a negative card index reaches the driver and triggers out-of-bounds (OOB) access on the index[] array and related parameters.

The fix adds a sanity check for the card index and warns or corrects the value when it falls outside the valid range.

Critical Impact
A local user with privileges to bind devices through sysfs can trigger out-of-bounds memory access in the kernel, potentially causing kernel memory corruption or a denial of service condition.

Affected Products

Linux kernel — ALSA portman2x4 MIDI driver (sound/drivers/portman2x4.c)
Multiple stable kernel branches, as indicated by the eight backport commits published on git.kernel.org
Systems exposing the parallel-port portman2x4 driver with sysfs bind capability

Discovery Timeline

2026-09-11 - CVE-2026-80966 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80966

Vulnerability Analysis

The portman2x4 driver initializes an ALSA sound card using a card index provided by the caller. The existing probe path validates the upper bound of devptr->id but does not guard against negative values. When a user binds the driver through sysfs using a non-numeric string such as none, the resulting index is negative and is then used to dereference the index[] parameter array and other per-card configuration structures.

This missing lower-bound validation is a classic input validation error [CWE-20] that produces an out-of-bounds read or write [CWE-125 / CWE-787] against kernel arrays. The impact depends on adjacent memory contents, but the operation occurs inside kernel context and can corrupt driver state or trigger a kernel oops.

Root Cause

The root cause is incomplete range validation in the portman2x4 probe function. The driver assumed the card index would always be a non-negative integer produced by the ALSA card enumeration path. Sysfs bind operations bypass that assumption by allowing arbitrary user-supplied identifiers, which are converted to a signed integer and passed unchecked into array indexing operations.

Attack Vector

Exploitation requires local access with sufficient privileges to write to the driver's sysfs bind interface, typically root or a user in a namespace with delegated device management. The attacker binds the portman2x4 driver with a crafted identifier that resolves to a negative value, causing the probe path to index kernel arrays outside their allocated bounds.

Because the vulnerability lives in a legacy parallel-port MIDI driver, exploitation is limited to systems that load snd-portman2x4 and expose its sysfs interface. Successful triggering may crash the kernel or corrupt neighboring ALSA metadata.

No verified proof-of-concept code is published. See the upstream commits for the exact patch content: Kernel Git Commit.

Detection Methods for CVE-2026-80966

Indicators of Compromise

Unexpected kernel warnings or oops messages referencing portman2x4, snd_card_new, or ALSA index arrays in dmesg.
Writes to /sys/bus/parallel/drivers/snd-portman2x4/bind containing non-numeric or unexpected identifiers.
Loading of the snd-portman2x4 module on systems without physical Portman 2x4 hardware.

Detection Strategies

Audit kernel logs for WARN_ON or BUG traces originating in sound/drivers/portman2x4.c.
Monitor auditd rules for write syscalls targeting sysfs bind and unbind files under parallel and sound subsystems.
Track kernel module loads for legacy ALSA drivers that are not required by the workload.

Monitoring Recommendations

Enable kernel lockdown or restrict CAP_SYS_ADMIN to reduce sysfs bind abuse from user space.
Forward dmesg and audit logs to a centralized analytics platform to correlate kernel crashes with driver-bind activity.
Alert on repeated ALSA card registration failures, which may indicate probing for out-of-range indices.

How to Mitigate CVE-2026-80966

Immediate Actions Required

Apply the upstream stable kernel updates that add the card index sanity check to portman2x4.
Blacklist the snd-portman2x4 module on systems that do not use Portman 2x4 hardware.
Restrict write access to sysfs bind interfaces to trusted administrators only.

Patch Information

The fix has been merged across multiple stable branches. Review the corresponding commits and apply the kernel package update supplied by your distribution:

Workarounds

Unload the snd-portman2x4 module with modprobe -r snd_portman2x4 where it is not required.
Add blacklist snd_portman2x4 to /etc/modprobe.d/ to prevent automatic loading.
Limit sysfs bind privileges through mandatory access controls such as SELinux or AppArmor policies.