CVE-2026-64490

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the ALSA virtio-snd control handling, the system trusts the control type and value count provided by the device. This metadata is used directly to index g v2a type map[] in the virtsnd kctl info() function, and to determine the size of loops and memcpy() operations in the virtsnd kctl get() and virtsnd kctl put() functions against fixed-size virtio snd ctl value and snd ctl elem value arrays. A malicious or buggy device can trigger out-of-bounds access by providing an invalid control type or an oversized value count.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.