CVE-2026-80972

A flaw was found in the ALSA (Advanced Linux Sound Architecture) aloop driver within the Linux kernel. This vulnerability arises from insufficient validation of the card index during device setup, specifically when a device is manually configured using the sysfs interface. A local attacker could exploit this by providing an invalid card index, leading to an out-of-bounds memory access. This could result in memory corruption, potentially affecting system stability or data integrity.

A moderate severity flaw was found in the ALSA aloop (audio loopback) driver in the Linux kernel shipped in Red Hat Enterprise Linux (kernel and kernel-rt), Red Hat In-Vehicle OS, and the RHCOS kernels used by OpenShift Container Platform 4. The aloop driver did not validate the card index supplied at device probe time. Devices that the driver itself creates during module load always use a valid index, but a device that is bound manually through the sysfs interface can carry an out-of-range value such as -1 ("none"), which the driver trusted, leading to an out-of-bounds access to the card index array and related parameters. A local attacker with the privileges needed to manually bind an aloop device via sysfs using an invalid card index could exploit this flaw to cause an out-of-bounds kernel memory access, resulting in memory corruption and most likely a kernel panic and system crash (denial of service). Red Hat has rated this flaw Moderate severity with a CVSS 3.1 base score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting a local attack path with high availability impact and no direct confidentiality or integrity impact. Because this flaw is Moderate with a CVSS score below 7.0, Red Hat is not filing trackers for it and the fix is deferred for the affected products, leaving a residual risk of local denial of service until a fix is shipped; the RHEL 6 Extended Lifecycle Support kernel stream is out of support scope and will not receive a fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The out-of-bounds access can only be triggered when an aloop device is bound manually through the sysfs interface with an out-of-range card index; devices the aloop driver itself creates at module load time are not affected. As a workaround, avoid manually binding aloop devices through the sysfs interface, and if ALSA loopback audio is not required, prevent the aloop kernel module from loading (for example by blacklisting it), which removes the vulnerable code path.