CVE-2026-74640

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc5

Description An out-of-bounds write exists in the ALSA FCP component. The function fcp ioctl set meter map() allows a user-supplied Level Meter map size up to 255, which is then stored as elem->channels. However, the snd ctl elem value structure uses an integer array value with a fixed limit of 128 elements. The function fcp meter ctl get() writes one 64-bit word per channel into this array without performing its own bounds check. This discrepancy allows data to be written past the allocated memory region, potentially affecting adjacent slab objects. While installing an oversized map requires CAP SYS RAWIO privileges, the resulting out-of-bounds stores can be triggered by any unprivileged process capable of reading controls on /dev/snd/controlC0.

Recommendations Update the Linux kernel to version 7.2.0-rc5 or later. As a temporary mitigation, restrict access to /dev/snd/controlC0 to prevent unprivileged users from triggering the issue.