CVE-2026-64490: ALSA: virtio: Validate control metadata from the device

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ALSA: virtio: Validate control metadata from the device

virtio-snd control handling trusts the device-provided control type and
value count returned by the device.

That metadata is then used directly to index g_v2a_type_map[] in
virtsnd_kctl_info(), and to size loops and memcpy() operations in
virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size
virtio_snd_ctl_value and snd_ctl_elem_value arrays.

A buggy or malicious device can therefore trigger out-of-bounds access by
advertising an invalid control type or an oversized value count.

Validate control type and count once in virtsnd_kctl_parse_cfg(), before
querying enumerated items or exposing the control to ALSA.

The Linux kernel CVE team has assigned CVE-2026-64490 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.9 with commit d6568e3de42dd971a1356f7ba581e6600d53f0a0 and fixed in 6.12.96 with commit 3243563f99ef5d3949b934bd6390a5679405d0e1
	Issue introduced in 6.9 with commit d6568e3de42dd971a1356f7ba581e6600d53f0a0 and fixed in 6.18.39 with commit 5da9742de22db0dbaa8d414214ab5e1bedde00f9
	Issue introduced in 6.9 with commit d6568e3de42dd971a1356f7ba581e6600d53f0a0 and fixed in 7.1.4 with commit 21584672fd699abe1768241d6c501b2de6139b6a
	Issue introduced in 6.9 with commit d6568e3de42dd971a1356f7ba581e6600d53f0a0 and fixed in 7.2-rc1 with commit c77a6cbb36ff8cbc1f084d94f8dcda5250935271

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64490
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/virtio/virtio_kctl.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3243563f99ef5d3949b934bd6390a5679405d0e1
	https://git.kernel.org/stable/c/5da9742de22db0dbaa8d414214ab5e1bedde00f9
	https://git.kernel.org/stable/c/21584672fd699abe1768241d6c501b2de6139b6a
	https://git.kernel.org/stable/c/c77a6cbb36ff8cbc1f084d94f8dcda5250935271