CVE-2026-80812

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) dummy driver. A local user, by manually binding a device via the sysfs interface with an invalid card index, could trigger an out-of-bounds memory access. This vulnerability arises because the snd_dummy_probe() function does not properly validate the provided device ID, potentially leading to system instability or denial of service.

Moderate severity is assigned to this flaw because exploitation requires local access and results exclusively in a denial of service via a kernel crash, without impacting confidentiality or system integrity. The affected dummy sound driver (snd-dummy) is not loaded by default in standard Red Hat Enterprise Linux installations and is generally limited to testing scenarios involving virtual audio devices. Furthermore, the issue can only be triggered when manually attaching a device through the sysfs driver binding interface, which requires administrative intervention under default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.