CVE-2026-74640

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: FCP: fix OOB write in fcp_meter_ctl_get()

fcp_ioctl_set_meter_map() bounds the user-supplied Level Meter map size

by the driver's own limit of 255

if (map.map_size < 1 || map.map_size > 255 ||

map.meter_slots < 1 || map.meter_slots > 255)

return -EINVAL;

and passes it to fcp_add_new_ctl() as the control's channel count, where

it is stored as elem->channels.

Every control read writes into struct snd_ctl_elem_value, whose integer

array is declared long value[128], so the limit is 128, not 255.

fcp_meter_ctl_get() stores one 64-bit word per channel into that array

with no bound of its own:

for (i = 0; i < elem->channels; i++) {

int idx = private->meter_level_map[i];

int value = idx < 0 ? 0 : le32_to_cpu(resp[idx]);

ucontrol->value.integer.value[i] = value;

}

snd_ctl_elem_read_user() serves that object from

memdup_user(_control, sizeof(*control)), 1224 bytes on LP64 out of

kmalloc-2048. offse

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References