CVE-2026-80970: Linux Kernel ALSA FCP Information Disclosure

CVE-2026-80970 Overview

CVE-2026-80970 is a kernel information disclosure vulnerability in the Linux Advanced Linux Sound Architecture (ALSA) Focusrite Control Protocol (FCP) driver. The fcp_ioctl_init() function allocates a response buffer with kmalloc() but neither zeroes the memory nor validates that the USB step-0 control transfer fully populated it. A short or zero-length device response leaves uninitialized slab memory in the buffer, which is then copied to userspace. Attackers with control of a suitably crafted USB device can leak kernel heap contents, including kernel text pointers useful for defeating Kernel Address Space Layout Randomization (KASLR).

Critical Impact
A malicious or emulated USB audio device can extract sensitive kernel heap data, including kernel text addresses, enabling further exploitation of the running kernel.

Affected Products

Linux kernel ALSA FCP driver (Focusrite Control Protocol)
Confirmed reproducible on Linux kernel 7.2.0-rc5 (arm64)
Systems exposing the FCP ioctl interface to unprivileged callers with USB device access

Discovery Timeline

Vulnerability discovered by XBOW, triaged by Baul Lee
2026-09-11 - CVE-2026-80970 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80970

Vulnerability Analysis

The defect resides in fcp_ioctl_init() in the Linux kernel ALSA FCP driver. The function allocates a response buffer sized by user-controlled fields (step0_resp_size + step2_resp_size, each validated only to the 1..255 range) using kmalloc(), which does not zero memory. The driver then issues a USB step-0 control transfer via snd_usb_ctl_msg() to populate the leading step0_resp_size bytes.

Because usb_fill_control_urb() does not set URB_SHORT_NOT_OK, a short or zero-length data stage completes with status 0. The driver checks only err < 0, so a short transfer is silently accepted. Inside snd_usb_ctl_msg(), the code path performs an unconditional memcpy(data, buf, size) back into the caller buffer, leaving the untouched trailing bytes as whatever the slab allocator returned.

The entire buffer is then copied to userspace via copy_to_user(). Reproduction on arm64 confirmed disclosure of a kernel text pointer (ffff8000805fc4a8) within the step-0 window. Enabling init_on_alloc=1 masked the leak, confirming the root cause is uninitialized heap memory [CWE-908].

Root Cause

Two issues combine to produce the disclosure. First, the response buffer is allocated with kmalloc() rather than kzalloc(), so contents of a recycled slab object are preserved. Second, the USB control transfer's actual_length is never checked against the requested step0_resp_size, so a short device response leaves a tail of uninitialized bytes that are copied out unchanged.

Attack Vector

An attacker supplies a crafted or emulated Focusrite-compatible USB device that responds to the step-0 vendor request with a zero-length or short data stage. When a local user issues the FCP init ioctl, the driver copies the uninitialized tail of the kernel slab object back to userspace. By varying step0_resp_size between 1 and 255, the attacker can steer allocation across kmalloc-8 through kmalloc-512 caches and harvest data from adjacent freed objects, including kernel pointers useful for KASLR bypass and follow-on exploitation.

No synthetic proof-of-concept is reproduced here. Refer to the upstream commits for the complete fix and reproduction details.

Detection Methods for CVE-2026-80970

Indicators of Compromise

Unexpected loading of the snd-usb-audio FCP driver in response to unknown or emulated USB device insertion
Userspace processes invoking the FCP init ioctl with step0_resp_size and step2_resp_size set to boundary values such as 255
USB control transfer logs showing short or zero-length data stages for FCP_USB_REQ_STEP0 requests

Detection Strategies

Audit kernel package versions across Linux endpoints to identify hosts running an unpatched ALSA FCP driver
Monitor udev and kernel logs for attachment of unfamiliar USB audio interfaces claiming Focusrite vendor identifiers
Instrument USB traffic on sensitive hosts to flag control transfers that complete with zero-length data stages against class-specific interfaces

Monitoring Recommendations

Enable kernel hardening options such as init_on_alloc=1 and monitor dmesg for FCP driver errors after enforcement
Track ioctl usage patterns from unprivileged processes targeting ALSA character devices under /dev/snd/
Correlate USB device insertion events with subsequent kernel driver activity in centralized logging platforms

How to Mitigate CVE-2026-80970

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the git.kernel.org commits for the ALSA FCP driver
Restrict physical and virtual USB device attachment on servers and workstations handling sensitive workloads
Enable init_on_alloc=1 as an interim defense-in-depth measure to zero freshly allocated slab memory

Patch Information

The fix is delivered in three upstream commits that zero the response buffer and require the step-0 transfer to deliver the full step0_resp_size bytes, treating a short data stage as an error. See Kernel Git Commit 29ab2df, Kernel Git Commit 4335e38, and Kernel Git Commit e9e5243.

Workarounds

Blacklist the ALSA FCP driver on systems where Focusrite USB audio devices are not required
Enforce USB device allowlisting through USBGuard or equivalent tooling to block unknown device attachments
Boot with init_on_alloc=1 to neutralize disclosure of uninitialized slab contents until patches can be applied

bash

# Blacklist the driver until the kernel is patched
echo "blacklist snd_usb_audio" | sudo tee /etc/modprobe.d/blacklist-fcp.conf
sudo update-initramfs -u

# Enable init_on_alloc as an interim mitigation via kernel cmdline
# Add init_on_alloc=1 to GRUB_CMDLINE_LINUX in /etc/default/grub, then:
sudo update-grub