CVE-2026-80969

A flaw was found in the Linux kernel's ALSA mpu401 driver. The driver fails to validate the card index when a device is manually bound through the sysfs interface. This oversight can lead to an out-of-bounds memory access. A local attacker with appropriate permissions could exploit this vulnerability to cause a denial of service or potentially achieve privilege escalation.

A flaw was found in the Linux kernel's ALSA mpu401 driver as shipped in Red Hat Enterprise Linux (kernel and kernel-rt) and in OpenShift Container Platform via the RHEL CoreOS layers. The driver blindly trusts the card index (devptr->id) at probe time without checking that it is within the valid range. Devices the driver creates itself at module probe time are safe, but when a device is bound manually through the sysfs interface the index can be out of range (for example -1, used as "none"), which leads to an out-of-bounds access of the index[] array and other parameters. A local attacker with the elevated privileges required to bind devices via sysfs could exploit this out-of-bounds access to cause a denial of service (kernel crash) or potentially escalate privileges. Red Hat rated this flaw MODERATE severity with a CVSS 3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); the impact is limited primarily to availability because exploitation requires local access with privileged sysfs device-binding operations. The fix is currently deferred for the affected Red Hat Enterprise Linux and OpenShift Container Platform streams because MODERATE-severity flaws with a CVSS score in this range do not meet the bar for an immediate kernel update; the residual risk until the fix is delivered is that a privileged local user who manually binds an mpu401 device through the sysfs interface could trigger the out-of-bounds access and crash the kernel.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.