CVE-2026-74640

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: FCP: fix OOB write in fcp_meter_ctl_get()<br /> <br /> fcp_ioctl_set_meter_map() bounds the user-supplied Level Meter map size<br /> by the driver&amp;#39;s own limit of 255<br /> <br /> if (map.map_size 255 ||<br /> map.meter_slots 255)<br /> return -EINVAL;<br /> <br /> and passes it to fcp_add_new_ctl() as the control&amp;#39;s channel count, where<br /> it is stored as elem-&gt;channels.<br /> <br /> Every control read writes into struct snd_ctl_elem_value, whose integer<br /> array is declared long value[128], so the limit is 128, not 255.<br /> fcp_meter_ctl_get() stores one 64-bit word per channel into that array<br /> with no bound of its own:<br /> <br /> for (i = 0; i channels; i++) {<br /> int idx = private-&gt;meter_level_map[i];<br /> int value = idx value.integer.value[i] = value;<br /> }<br /> <br /> snd_ctl_elem_read_user() serves that object from<br /> memdup_user(_control, sizeof(*control)), 1224 bytes on LP64 out of<br /> kmalloc-2048. offsetof(struct snd_ctl_elem_value, value) is 72, so<br /> element i is written at byte 72 + 8 * i and element 144 already lands<br /> past the allocation. At map_size 255 the last store ends at byte 2112,<br /> 888 bytes past the object and 64 bytes into the adjacent slab object.<br /> The stored words come from the device and meter_level_map[] selects<br /> which word lands in which slot, so extent and contents are both<br /> controlled.<br /> <br /> The core does not catch this. snd_ctl_check_elem_info() is reached only<br /> from __snd_ctl_elem_info(), which snd_ctl_elem_read() calls under<br /> CONFIG_SND_CTL_DEBUG; without that option snd_ctl_skip_validation() is a<br /> compile-time true. __snd_ctl_add_replace() validates kcontrol-&gt;count and<br /> never inspects elem-&gt;channels.<br /> <br /> Installing an oversized map needs CAP_SYS_RAWIO, but the control outlives<br /> the hwdep descriptor that created it, so the out-of-bounds stores are<br /> issued by any process able to read controls on /dev/snd/controlC0.<br /> <br /> KASAN on 7.2.0-rc5 (arm64), triggered by an unprivileged control read:<br /> <br /> BUG: KASAN: slab-out-of-bounds in fcp_meter_ctl_get<br /> Write of size 8 at addr ffff000017af04c8 by task fcp_trigger/185<br /> __asan_store8<br /> fcp_meter_ctl_get<br /> snd_ctl_elem_read<br /> snd_ctl_ioctl<br /> Allocated by task 185:<br /> memdup_user<br /> snd_ctl_ioctl<br /> The buggy address is located 0 bytes to the right of<br /> allocated 1224-byte region [ffff000017af0000, ffff000017af04c8)<br /> <br /> Bound the map size by the ABI limit rather than by 255, and bound the<br /> store loop at the sink so it cannot run past the value array whatever<br /> elem-&gt;channels holds.<br /> <br /> Discovered by XBOW, triaged by Baul Lee