CVE-2026-80969: Linux Kernel ALSA MPU401 Buffer Overflow

CVE-2026-80969 Overview

CVE-2026-80969 is a Linux kernel vulnerability in the Advanced Linux Sound Architecture (ALSA) mpu401 driver. The driver trusts the devptr->id value at probe time without validating that it falls within the expected card index range. When a device is bound manually through the sysfs interface, the identifier can be -1 (representing "none"), which causes out-of-bounds (OOB) access to the index[] array and related parameters. The upstream fix adds a sanity check on the card index and warns or corrects invalid values at probe.

Critical Impact
Out-of-bounds access in kernel space caused by an unvalidated card index in the mpu401 driver, reachable through sysfs-driven manual device binding.

Affected Products

Linux kernel sound/drivers/mpu401 subsystem (ALSA)
Multiple stable kernel branches patched via upstream commits
Systems exposing ALSA driver binding through sysfs

Discovery Timeline

2026-09-11 - CVE-2026-80969 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80969

Vulnerability Analysis

The mpu401 ALSA driver reads devptr->id at probe and uses it as an index into the module's per-card parameter arrays, including index[]. When the kernel loads the driver on its own devices, the identifier is always valid. Manual binding through the sysfs bind attribute breaks that assumption, because a device attached this way can carry an identifier of -1 used to signify "none". The driver then performs array accesses outside the declared bounds of index[] and adjacent parameter arrays. Depending on the surrounding memory layout, this results in reading or writing kernel data belonging to unrelated structures. The patch introduces a sanity check that verifies the card index against the valid range and warns or clamps the value when it falls outside that range, ensuring the driver operates only on legitimate slots.

Root Cause

The root cause is missing input validation on devptr->id before it is used as an array index. The mpu401 probe path treats the identifier as trusted, without verifying that it is non-negative and within the array bounds defined by the module's per-card parameters.

Attack Vector

Exploitation requires local access sufficient to write to the sysfs driver bind attribute, an operation typically restricted to privileged users. An actor with that access can bind an mpu401 device with an invalid identifier, triggering out-of-bounds access during probe. The vulnerability is a local kernel memory safety defect and is not remotely reachable through normal network paths.

No public proof-of-concept is referenced in the advisory. See the kernel commit history for the exact code path that was corrected.

Detection Methods for CVE-2026-80969

Indicators of Compromise

Kernel log messages referencing snd-mpu401 probe failures or warnings introduced by the sanity-check patch.
Unexpected writes to /sys/bus/*/drivers/snd-mpu401/bind from non-administrative workflows.
Kernel oops, KASAN reports, or slab-out-of-bounds warnings originating from the mpu401 probe path.

Detection Strategies

Audit kernel logs (dmesg, journalctl -k) for ALSA subsystem warnings and out-of-bounds messages tied to snd-mpu401.
Monitor auditd rules on /sys/bus/**/drivers/snd-mpu401/bind and unbind files to identify manual driver binding.
Compare running kernel build IDs against the fixed commits listed in the upstream references to confirm patch status.

Monitoring Recommendations

Enable KASAN on test kernels to catch OOB access originating from ALSA drivers during QA.
Alert on privileged process activity that writes to sysfs bind attributes on sound drivers in production.
Track kernel package versions across the fleet and flag hosts still running unpatched ALSA builds.

How to Mitigate CVE-2026-80969

Immediate Actions Required

Upgrade to a Linux kernel release that includes one of the upstream fix commits referenced by NVD.
Restrict access to sysfs driver bind and unbind interfaces to trusted administrative users only.
Unload or blacklist the snd-mpu401 module on systems that do not require MIDI (Musical Instrument Digital Interface) MPU-401 support.

Patch Information

The fix adds a card index sanity check inside the mpu401 probe path. It is distributed across multiple stable branches through commits 26a25fb4, 3a997371, 4a3d6c22, 76b6bc38, 8adda66e, cc4215cc, d606c703, and f7dcecb9. Apply the vendor kernel update that references these commits.

Workarounds

Blacklist the module by adding blacklist snd-mpu401 to /etc/modprobe.d/ on systems without MIDI requirements.
Enforce restrictive permissions on /sys/bus/*/drivers/snd-mpu401/bind to prevent manual driver binding by non-root users.
Limit sysfs write access via mandatory access control policies such as SELinux or AppArmor for user-facing services.

bash

# Configuration example
echo 'blacklist snd-mpu401' | sudo tee /etc/modprobe.d/disable-mpu401.conf
sudo depmod -a
sudo rmmod snd_mpu401 2>/dev/null || true