CVE-2026-80972: Linux Kernel ALSA Privilege Escalation

CVE-2026-80972 Overview

CVE-2026-80972 is a vulnerability in the Linux kernel's ALSA aloop (Advanced Linux Sound Architecture loopback) driver. The driver trusts the devptr->id value at probe time without validating that it falls within the proper card index range. When the device is bound manually through the sysfs interface, this value can be -1 (representing "none"), leading to out-of-bounds access on the index[] array and other parameter arrays. The upstream fix adds a sanity check for the card index and warns or corrects it when the value falls outside the acceptable range.

Critical Impact
A local user with privileges to bind devices through sysfs can trigger out-of-bounds memory access in the kernel, potentially causing memory corruption or a denial of service.

Affected Products

Linux kernel — ALSA aloop driver (sound/drivers/aloop.c)
Multiple stable kernel branches receiving the backported fix
Systems where the snd-aloop module can be manually bound via sysfs

Discovery Timeline

2026-09-11 - CVE-2026-80972 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80972

Vulnerability Analysis

The aloop driver in the Linux kernel implements a virtual sound card that loops PCM output back as input, commonly used for audio testing and inter-application audio routing. During probe, the driver uses devptr->id as an index into module parameter arrays such as index[], id[], enable[], and pcm_substreams[]. The driver assumes this identifier is always a valid card index within the range configured at module load.

This assumption holds when the module itself instantiates devices at load time. However, when an administrator manually binds a device through the /sys/bus/platform/drivers/.../bind interface, devptr->id can be -1, signaling that no specific ID was assigned. Using a negative value to index into fixed-size arrays produces out-of-bounds reads and writes in kernel memory.

Root Cause

The root cause is missing input validation [CWE-20] at the driver probe boundary. The driver treats externally influenced state as trusted and performs unchecked array indexing, resulting in an out-of-bounds access condition [CWE-125 / CWE-787]. The patch introduces a sanity check that verifies the card index falls within the valid range and emits a warning or corrects the value when it does not.

Attack Vector

Exploitation requires local privileges sufficient to interact with the platform driver sysfs bind interface, typically root or an equivalent capability. An attacker who can bind an aloop platform device with an unassigned identifier triggers the negative index path during probe. The resulting out-of-bounds access reads or writes kernel memory adjacent to the parameter arrays. The primary impact is kernel memory corruption or denial of service through a kernel oops; escalation to code execution would depend on adjacent kernel data layout. See the upstream fixes in the Linux Kernel Commit 819b106a and Linux Kernel Commit 6da6ffb for the exact code path.

Detection Methods for CVE-2026-80972

Indicators of Compromise

Kernel log entries referencing snd-aloop probe warnings, invalid card index values, or corrected index assignments.
Kernel oops or panic traces originating in sound/drivers/aloop.c during device bind operations.
Unexpected writes to /sys/bus/platform/drivers/snd_aloop/bind from non-administrative workflows.

Detection Strategies

Inventory running kernel versions and compare against the fixed stable branches referenced by the upstream commits.
Audit systems that load the snd-aloop module in production, especially container hosts and multi-tenant environments where sound loopback is not required.
Monitor for privileged processes writing to platform driver bind/unbind sysfs entries that were not previously observed.

Monitoring Recommendations

Forward dmesg and journald output to a centralized log store and alert on aloop probe warnings or kernel BUG traces.
Track kernel module load events using auditd rules on the init_module and finit_module syscalls for snd_aloop.
Alert on new invocations of echo ... > /sys/bus/platform/drivers/*/bind outside of expected administrative sessions.

How to Mitigate CVE-2026-80972

Immediate Actions Required

Apply the stable kernel update containing the upstream fixes and reboot affected systems.
If snd-aloop is not required, blacklist the module to remove the attack surface entirely.
Restrict access to platform driver sysfs bind/unbind interfaces to trusted administrators only.

Patch Information

The issue is resolved by adding a sanity check for the card index at probe time. Fixes have been merged across multiple stable branches. Reference the following commits: Linux Kernel Commit 819b106a, Linux Kernel Commit 6da6ffb, Linux Kernel Commit 6fe7d136, Linux Kernel Commit 7b3f9855, Linux Kernel Commit c589aeaa, Linux Kernel Commit e35d1110, and Linux Kernel Commit efbc2e9e. Consult your distribution's security tracker for the specific package version that carries the backport.

Workarounds

Blacklist the snd-aloop module by adding blacklist snd_aloop to /etc/modprobe.d/ and rebuilding the initramfs where applicable.
Prevent runtime loading with install snd_aloop /bin/true in a modprobe configuration file.
Tighten Mandatory Access Control policy (SELinux, AppArmor) to deny write access to platform driver bind sysfs paths for non-root or non-administrative contexts.

bash

# Configuration example: prevent the vulnerable module from loading
echo "blacklist snd_aloop" | sudo tee /etc/modprobe.d/blacklist-snd-aloop.conf
echo "install snd_aloop /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-snd-aloop.conf
sudo rmmod snd_aloop 2>/dev/null || true
sudo update-initramfs -u