CVE-2026-90781 Overview
CVE-2026-90781 is an off-by-one stack buffer overflow in the Advanced Linux Sound Architecture library (alsa-lib) through version 1.2.16.1. The flaw resides in the __snd_ctl_ascii_elem_id_parse() function inside src/control/ctlparse.c. When the parser processes a name= field containing 64 or more characters, it writes one byte past a 64-byte stack buffer. An attacker with local access can supply a crafted control-element identifier through saved ALSA state files or command-line arguments to overwrite adjacent stack memory and crash the calling process. The issue is tracked under CWE-193 (Off-by-one Error).
Critical Impact
Local attackers can trigger memory corruption and denial of service in any process that parses untrusted ALSA control identifier strings.
Affected Products
- ALSA Project alsa-lib versions up to and including 1.2.16.1
- Linux distributions bundling vulnerable alsa-lib builds
- Applications and utilities linking against libasound that parse ALSA state files or user-supplied control identifiers
Discovery Timeline
- 2026-09-13 - CVE-2026-90781 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90781
Vulnerability Analysis
The vulnerability exists in the ASCII control-element identifier parser used by alsa-lib to interpret strings such as name='Master Playback Volume'. The parser copies characters from the input into a fixed 64-byte stack buffer while tracking the current size. The boundary check compares size against sizeof(buf) instead of sizeof(buf) - 1, allowing one additional byte to be written before the terminator is appended. Supplying a name= value of 64 or more characters causes the writer to store data one byte beyond the buffer, corrupting adjacent stack state such as saved registers or the return address slot.
Exploitation typically results in process termination when stack canaries or ABI-required alignment values are clobbered. On builds without stack protection, the overflow may enable more targeted memory corruption. The primary practical impact is denial of service in tools such as alsactl when restoring attacker-controlled state files.
Root Cause
The root cause is an incorrect boundary comparison inside the quoted-string handling loop of __snd_ctl_ascii_elem_id_parse(). The condition size < (int)sizeof(buf) permits writes up to index 64 in a 64-byte buffer, leaving no room for the trailing NUL byte and producing a classic [CWE-193] off-by-one overflow.
Attack Vector
The attack vector is local. An attacker must supply a crafted ALSA control-element identifier through a mechanism the target process trusts, such as a saved state file consumed by alsactl restore, configuration entries in /etc/asound.state, or command-line arguments to amixer and similar utilities. Successful exploitation crashes the parsing process and interrupts audio subsystem management.
// Patch from src/control/ctlparse.c - corrects the off-by-one boundary check
if (*str == '\'' || *str == '\"') {
c = *str++;
while (*str && *str != c) {
- if (size < (int)sizeof(buf)) {
+ if (size < (int)sizeof(buf) - 1) {
*ptr++ = *str;
size++;
}
// Source: https://github.com/alsa-project/alsa-lib/commit/f84cd4ced7b36fddb8e4ee24404cf7c091d27020
Detection Methods for CVE-2026-90781
Indicators of Compromise
- Unexpected crashes or SIGABRT termination of alsactl, amixer, or applications linking libasound during state restore operations.
- ALSA state files or configuration entries containing name= fields with quoted strings of 64 or more characters.
- Core dumps referencing __snd_ctl_ascii_elem_id_parse in the crashing call stack.
Detection Strategies
- Inventory installed alsa-lib package versions and flag hosts running 1.2.16.1 or earlier.
- Scan writable ALSA state files (/var/lib/alsa/asound.state, user-supplied restore files) for oversized name= identifiers.
- Monitor process telemetry for repeated aborts in ALSA userspace utilities as a signal of exploitation attempts.
Monitoring Recommendations
- Enable coredump collection for ALSA userspace tools and forward crash metadata to centralized logging.
- Audit changes to shared ALSA configuration files under /etc/ and per-user state paths.
- Track invocation of alsactl restore with non-default state files, particularly in multi-user or shared systems.
How to Mitigate CVE-2026-90781
Immediate Actions Required
- Upgrade alsa-lib to a version that includes commit f84cd4ced7b36fddb8e4ee24404cf7c091d27020 or apply the vendor patch.
- Restrict write access to ALSA state files so only trusted administrators can modify restore inputs.
- Rebuild and redistribute any downstream packages that statically link vulnerable alsa-lib code.
Patch Information
The ALSA Project has published a fix in the upstream repository. The corrective commit is f84cd4c, which changes the boundary check to size < (int)sizeof(buf) - 1. Additional context is available in the VulnCheck advisory and the kernel mailing list discussion.
Workarounds
- Avoid invoking alsactl restore against untrusted state files until the patched library is deployed.
- Enforce filesystem permissions preventing non-privileged users from modifying ALSA state or configuration files.
- Validate that any tooling generating ALSA identifiers truncates name= values to fewer than 64 characters.
# Verify installed alsa-lib version and inspect state files for oversized identifiers
dpkg -s libasound2 2>/dev/null | grep -E '^Version'
rpm -q alsa-lib 2>/dev/null
# Flag name= fields with 64+ characters inside quotes
grep -RhoE "name=['\"][^'\"]{64,}['\"]" /etc/asound.state /var/lib/alsa/ 2>/dev/null
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
