ALSA: portman2x4: Check card index validity at probe
Summary
| CVE | CVE-2026-80966 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-11 20:19:02 UTC |
| Updated | 2026-09-13 07:17:03 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: ALSA: portman2x4: Check card index validity at probe Although portman2x4 driver has a check of the given devptr->id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via sysfs. This may lead to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range. |
Risk And Classification
EPSS: 0.002000000 probability, percentile 0.099340000 (date 2026-09-13)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 757e119bf52b014b3181eed97b01f87a245b8ff9 0ce391090809d610647f424b9b1dc24aa2c546fd git | Not specified |
| CNA | Linux | Linux | affected 757e119bf52b014b3181eed97b01f87a245b8ff9 d7ef7890e3e35b4ba09e76fc6b72047a1599a5e8 git | Not specified |
| CNA | Linux | Linux | affected 757e119bf52b014b3181eed97b01f87a245b8ff9 e1ce8ad1009b1736b3044b3324350dcfdd516f42 git | Not specified |
| CNA | Linux | Linux | affected 757e119bf52b014b3181eed97b01f87a245b8ff9 3690ef20469d5959378260e2752f2314a2572913 git | Not specified |
| CNA | Linux | Linux | affected 2.6.21 | Not specified |
| CNA | Linux | Linux | unaffected 2.6.21 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.109 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.50 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2.4 7.2.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.3-rc1 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/3690ef20469d5959378260e2752f2314a2572913 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/e1ce8ad1009b1736b3044b3324350dcfdd516f42 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/0ce391090809d610647f424b9b1dc24aa2c546fd | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/d7ef7890e3e35b4ba09e76fc6b72047a1599a5e8 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.