{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-74640",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-74640"
  ],
  "published": "2026-08-22T15:32:12Z",
  "summary": "ALSA: FCP: fix OOB write in fcp_meter_ctl_get()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: FCP: fix OOB write in fcp_meter_ctl_get()\n\nfcp_ioctl_set_meter_map() bounds the user-supplied Level Meter map size\nby the driver's own limit of 255\n\n\tif (map.map_size < 1 || map.map_size > 255 ||\n\t    map.meter_slots < 1 || map.meter_slots > 255)\n\t\treturn -EINVAL;\n\nand passes it to fcp_add_new_ctl() as the control's channel count, where\nit is stored as elem->channels.\n\nEvery control read writes into struct snd_ctl_elem_value, whose integer\narray is declared long value[128], so the limit is 128, not 255.\nfcp_meter_ctl_get() stores one 64-bit word per channel into that array\nwith no bound of its own:\n\n\tfor (i = 0; i < elem->channels; i++) {\n\t\tint idx = private->meter_level_map[i];\n\t\tint value = idx < 0 ? 0 : le32_to_cpu(resp[idx]);\n\n\t\tucontrol->value.integer.value[i] = value;\n\t}\n\nsnd_ctl_elem_read_user() serves that object from\nmemdup_user(_control, sizeof(*control)), 1224 bytes on LP64 out of\nkmalloc-2048.  offsetof(struct snd_ctl_elem_value, value) is 72, so\nelement i is written at byte 72 + 8 * i and element 144 already lands\npast the allocation.  At map_size 255 the last store ends at byte 2112,\n888 bytes past the object and 64 bytes into the adjacent slab object.\nThe stored words come from the device and meter_level_map[] selects\nwhich word lands in which slot, so extent and contents are both\ncontrolled.\n\nThe core does not catch this.  snd_ctl_check_elem_info() is reached only\nfrom __snd_ctl_elem_info(), which snd_ctl_elem_read() calls under\nCONFIG_SND_CTL_DEBUG; without that option snd_ctl_skip_validation() is a\ncompile-time true.  __snd_ctl_add_replace() validates kcontrol->count and\nnever inspects elem->channels.\n\nInstalling an oversized map needs CAP_SYS_RAWIO, but the control outlives\nthe hwdep descriptor that created it, so the out-of-bounds stores are\nissued by any process able to read controls on /dev/snd/controlC0.\n\nKASAN on 7.2.0-rc5 (arm64), triggered by an unprivileged control read:\n\n  BUG: KASAN: slab-out-of-bounds in fcp_meter_ctl_get\n  Write of size 8 at addr ffff000017af04c8 by task fcp_trigger/185\n   __asan_store8\n   fcp_meter_ctl_get\n   snd_ctl_elem_read\n   snd_ctl_ioctl\n  Allocated by task 185:\n   memdup_user\n   snd_ctl_ioctl\n  The buggy address is located 0 bytes to the right of\n   allocated 1224-byte region [ffff000017af0000, ffff000017af04c8)\n\nBound the map size by the ABI limit rather than by 255, and bound the\nstore loop at the sink so it cannot run past the value array whatever\nelem->channels holds.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:13",
        "name": "linux"
      },
      "versions": [
        "1:6.18.29-1+rpt1",
        "1:6.18.33-1+rpt1",
        "1:6.18.34-1+rpt1",
        "1:6.18.39-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.18.29+rpt-rpi-2712",
            "binary_version": "1:6.18.29-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.29+rpt-rpi-v6",
            "binary_version": "1:6.18.29-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.29+rpt-rpi-v7",
            "binary_version": "1:6.18.29-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.29+rpt-rpi-v8",
            "binary_version": "1:6.18.29-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt",
            "binary_version": "1:6.18.29-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.33+rpt-rpi-2712",
            "binary_version": "1:6.18.33-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.33+rpt-rpi-v6",
            "binary_version": "1:6.18.33-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.33+rpt-rpi-v7",
            "binary_version": "1:6.18.33-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.33+rpt-rpi-v8",
            "binary_version": "1:6.18.33-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt",
            "binary_version": "1:6.18.33-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.34+rpt-rpi-2712",
            "binary_version": "1:6.18.34-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.34+rpt-rpi-v6",
            "binary_version": "1:6.18.34-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.34+rpt-rpi-v7",
            "binary_version": "1:6.18.34-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.34+rpt-rpi-v8",
            "binary_version": "1:6.18.34-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt",
            "binary_version": "1:6.18.34-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.39+rpt-rpi-2712",
            "binary_version": "1:6.18.39-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.39+rpt-rpi-v6",
            "binary_version": "1:6.18.39-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.39+rpt-rpi-v7",
            "binary_version": "1:6.18.39-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.39+rpt-rpi-v8",
            "binary_version": "1:6.18.39-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt",
            "binary_version": "1:6.18.39-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.18.29-1+rpt1": {
            "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc",
            "upstream_version": "6.18.29",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.18.45"
          },
          "1:6.18.33-1+rpt1": {
            "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412",
            "upstream_version": "6.18.33",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.18.45"
          },
          "1:6.18.34-1+rpt1": {
            "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af",
            "upstream_version": "6.18.34",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.18.45"
          },
          "1:6.18.39-1+rpt1": {
            "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff",
            "upstream_version": "6.18.39",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.18.45"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74640"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/bb30e35c36ed00f24fa39aded811f64230a913b0"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/bb61dc2ae59026f76db26e1909746908bc5b6f31"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/620f1e52a46f604635efd0fb78138afd6a513b5d"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-25T05:42:41Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - Exploitation is triggered by a local process issuing SNDRV_CTL_IOCTL_ELEM_READ on /dev/snd/controlC0, which reaches fcp_meter_ctl_get() via snd_ctl_elem_read_user(); there is no network, Bluetooth, or remote packet path to this code.\nAC:L - After a Level Meter map with map_size above 128 is configured, each control read deterministically performs up to 888 bytes of out-of-bounds 64-bit stores past the kmalloc-2048 buffer; no races or attacker-uncontrollable timing are required.\nPR:L - KASAN reproduced the slab OOB write from an unprivileged control read; snd_ctl_open has no capability check and the Level Meter control persists after hwdep close, so any local user with /dev/snd/controlC0 access can trigger it after normal fcp-server setup.\nUI:N - The attacker directly opens /dev/snd/controlC0 and issues the elem-read ioctl themselves; no separate victim action such as opening a file or mounting a filesystem is required.\nS:U - Impact is kernel heap corruption and local privilege escalation within the host kernel; it does not cross VM, container, or IOMMU security boundaries.\nC:H - Out-of-bounds writes corrupt up to 888 bytes beyond snd_ctl_elem_value into adjacent slab objects; attacker-influenced meter_level_map selects written values, enabling heap grooming and potential arbitrary kernel memory disclosure.\nI:H - Unbounded 64-bit stores past the 128-element value array corrupt adjacent kmalloc-2048 slab data with partially attacker-controlled contents, providing a heap corruption primitive suitable for kernel code or data overwrite.\nA:H - KASAN reported slab-out-of-bounds writes during an unprivileged control read; corrupting adjacent slab objects can cause kernel oops, panic, or hang, confirming high availability impact."
    }
  }
}