CVE-2026-74640

A flaw was found in the Linux kernel's ALSA FireWire Control Protocol (FCP). An unprivileged process can trigger an out-of-bounds write by reading controls on /dev/snd/controlC0 after an oversized Level Meter map has been installed. This occurs because the fcp_meter_ctl_get() function writes beyond its allocated buffer when processing a user-supplied map size that exceeds the buffer's actual limit. This out-of-bounds write can lead to memory corruption, potentially allowing for denial of service, information disclosure, or arbitrary code execution.

This vulnerability is rated as Important severity because an out-of-bounds heap write in the kernel can be triggered by a local unprivileged user, potentially enabling arbitrary code execution or a system crash. In typical Red Hat Enterprise Linux server environments, sound subsystems and USB audio interfaces are neither configured nor actively utilized, significantly limiting exposure. Furthermore, configuring the oversized control map prerequisite requires elevated capabilities (CAP_SYS_RAWIO) before subsequent reads on the ALSA sound control interface can induce memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the snd-usb-audio kernel module from being loaded by blacklisting it in the modprobe configuration.

1. Add the install directive to prevent the module from loading:

echo "install snd-usb-audio /bin/true" > /etc/modprobe.d/disable-snd-usb-audio.conf

2. If the module is currently loaded, unload it or restart the system for changes to take effect:

modprobe -r snd-usb-audio

Warning: If the module is currently in use and cannot be unloaded dynamically, a system reboot will be required.

Caveat: Disabling the snd-usb-audio module prevents the system from utilizing any USB audio hardware devices.