CVE-2026-80970

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) FireWire Control Protocol (FCP) subsystem. This vulnerability allows a local attacker to trigger the copying of uninitialized kernel memory to userspace. By sending a specially crafted short or zero-length data stage during the FCP initialization, an attacker could potentially read sensitive information from the kernel's memory.

An information disclosure bug in the ALSA FCP ioctl path can copy uninitialized kernel heap bytes to userspace. fcp_ioctl_init allocates the response buffer with kmalloc and later copies the full buffer to the caller, while a short or zero length USB step0 response can leave part of the buffer unchanged. For the CVSS the PR:L is used because a local user or local process must be able to access the ALSA control interface for the affected USB device. The issue is not network reachable. Impact is confidentiality loss only, with possible kernel pointer disclosure and KASLR weakening. The bug requires a suitable or malicious FCP USB device, so real exposure is mostly local systems where such USB audio hardware is attached or can be attached.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.