CVE-2026-96675: alsa-lib Multi PCM Plugin DOS Vulnerability

CVE-2026-96675 Overview

CVE-2026-96675 is a denial of service vulnerability in the Advanced Linux Sound Architecture library (alsa-lib) through version 1.2.16.1. The flaw resides in the multi Pulse Code Modulation (PCM) plugin, which fails to validate sparse binding indices before performing array access. A local attacker can supply a malicious ALSA configuration file containing sparse bindings to trigger an out-of-bounds array read and an assertion failure. The result is an application abort in any process linked against alsa-lib that loads the crafted configuration. The weakness is classified under CWE-129: Improper Validation of Array Index.

Critical Impact
Local attackers can crash any application that consumes attacker-controlled ALSA configuration through the multi PCM plugin, disrupting audio-dependent services.

Affected Products

alsa-lib versions up to and including 1.2.16.1
Linux distributions and applications that link against the vulnerable alsa-lib multi PCM plugin
Audio-processing services that load user-supplied ALSA configuration files

Discovery Timeline

2026-09-23 - CVE-2026-96675 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD

Technical Details for CVE-2026-96675

Vulnerability Analysis

The defect lives in the multi PCM plugin implementation in src/pcm/pcm_multi.c, specifically in the code path that resolves binding indices for combined PCM streams. The multi plugin allows an ALSA configuration to combine several slave PCMs into a single logical device, mapping logical channels onto slave channels via a bindings table.

When the configuration declares sparse bindings, index values in the table may skip positions or exceed the expected channel count. The plugin uses the supplied index to access an internal array without first checking that the index falls within the allocated bounds. This produces an out-of-bounds read and drives the process into an assertion that calls abort(), terminating the host application.

Because alsa-lib is loaded by a wide range of audio-consuming processes, exploitation converts a configuration parsing step into a reliable crash primitive. The impact is limited to availability; the vulnerability does not disclose data or enable code execution.

Root Cause

The root cause is missing validation of user-controlled array indices ([CWE-129]) in the multi PCM plugin binding logic. The plugin trusts the sparse index values declared in .asoundrc or other ALSA configuration sources and dereferences the internal bindings array before enforcing a bounds check. See the vulnerable region in the ALSA multi PCM source and the corresponding fix in ALSA PR #527.

Attack Vector

Exploitation requires local access with the ability to influence the ALSA configuration loaded by a target process. A common vector is writing a crafted ~/.asoundrc or supplying a malicious configuration path through environment variables. When the target process initializes the multi PCM device, alsa-lib parses the sparse bindings, reads out of bounds, and aborts. Refer to the VulnCheck advisory for additional context.

Detection Methods for CVE-2026-96675

Indicators of Compromise

Unexpected SIGABRT terminations in processes linked against libasound.so.2 shortly after opening a PCM device.
Presence of user-writable ALSA configuration files (~/.asoundrc, /etc/asound.conf) containing type multi definitions with non-contiguous or unusually large binding indices.
Core dumps whose stack traces include snd_pcm_multi_open or related symbols from pcm_multi.c.

Detection Strategies

Audit ALSA configuration files for type multi blocks and verify that declared bindings remain within the channel counts of their slave PCMs.
Enable core dump collection on audio and multimedia services to capture abort signatures matching the multi PCM plugin.
Track the installed alsa-lib version across the fleet and flag hosts running 1.2.16.1 or earlier.

Monitoring Recommendations

Forward journald and auditd records for repeated crashes in audio pipelines, PulseAudio, PipeWire, and applications that embed alsa-lib.
Monitor filesystem changes to ~/.asoundrc and /etc/asound.conf on multi-user systems.
Correlate process abort events with recent configuration file modifications by non-privileged users.

How to Mitigate CVE-2026-96675

Immediate Actions Required

Inventory all hosts running alsa-lib at or below 1.2.16.1 and prioritize patching on shared and multi-user systems.
Restrict write permissions on /etc/asound.conf and validate that user home directories do not contain untrusted .asoundrc files on shared workstations.
Review audio service configurations to ensure that only trusted principals can influence PCM configuration inputs.

Patch Information

The fix is tracked in ALSA PR #527 in the alsa-project/alsa-lib repository. Apply the upstream patch or upgrade to a version of alsa-lib released after 1.2.16.1 that includes the sparse binding index validation. Distribution maintainers should track downstream package updates and rebuild dependent audio stacks.

Workarounds

Remove or neutralize type multi PCM definitions from ALSA configuration until patched builds are deployed.
Enforce read-only, root-owned ALSA configuration on production systems to prevent local users from supplying malicious bindings.
Sandbox audio-processing services with mandatory access controls (SELinux, AppArmor) to limit which configuration files they can load.

bash

# Configuration example: restrict ALSA configuration to root-owned files
sudo chown root:root /etc/asound.conf
sudo chmod 644 /etc/asound.conf

# Prevent per-user overrides on shared hosts
for home in /home/*; do
  if [ -f "$home/.asoundrc" ]; then
    sudo mv "$home/.asoundrc" "$home/.asoundrc.disabled"
  fi
done