CVE-2026-80970

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: FCP: do not copy out an uninitialised init response

fcp_ioctl_init() allocates its response buffer with kmalloc() and copies

the whole buffer back to userspace:

buf_size = init.step0_resp_size + init.step2_resp_size;

void *resp __free(kfree) =

kmalloc(buf_size, GFP_KERNEL);

...

if (copy_to_user(arg->resp, resp, buf_size))

return -EFAULT;

Nothing clears the buffer, and the only writer of its leading

step0_resp_size bytes is the step-0 control transfer:

err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0),

FCP_USB_REQ_STEP0,

USB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_IN,

0, private->bInterfaceNumber,

step0_resp, private->step0_resp_size);

if (err < 0)

return err;

usb_fill_control_urb() does not set URB_SHORT_NOT_OK, so a short or

zero-length data stage completes with status 0 and snd_usb_ctl_msg()

returns a small actual_length. The only check is err < 0, so a short

transfer is accepted

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References