CVE-2026-64490

ALSA virtio control handling trusted control metadata returned by the virtio-snd device without sufficiently validating the control type and value count. An invalid control type can cause an out-of-bounds index into g_v2a_type_map[], while an oversized value count can drive loops and memcpy() operations beyond the bounds of the fixed-size virtio_snd_ctl_value and snd_ctl_elem_value arrays. This represents a device-to-guest attack surface rather than a network- or packet-reachable vulnerability.

Exploitation requires control over a virtio-snd device or its backend in order to provide crafted control metadata to the guest kernel. An ordinary unprivileged local user inside the guest cannot directly supply the required malicious metadata through normal ALSA interfaces. This significantly restricts the practical attack surface and requires a specially controlled or compromised virtualization environment.

Although the CVSS score is 7.0, these exploitation prerequisites justify rating the issue as Moderate. A malicious or compromised virtio-snd device can trigger out-of-bounds kernel memory accesses and at minimum cause a guest kernel crash, resulting in denial of service. Confidentiality and integrity impacts may also be possible because attacker-controlled metadata is used in operations involving fixed-size kernel buffers. However, exploitation beyond denial of service has not been demonstrated.