Riskcovery

CVE-2026-90060

ALSA: control: Don't add invalid kcontrols to LED layer

State
Published
Severity
Not scored
Published
Sep 17, 2026
Updated
Oct 21, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: control: Don't add invalid kcontrols to LED layer

The kcontrol LED state layer tries to track the all associated kcontrol elements with naive assumptions that they are readable. But one can create a write-only element that has no get callback (even a user element can do it), and this may lead to a NULL dereference at the call chain of snd_ctl_led_notify(), as found by syzkaller.

For avoiding the Oops, add a sanity check of the kcontrol's info and get callbacks, and just skip the invalid kcontrols before assigning the kctl to the LED layer.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 22d8de62f11b287b279f1d4473a78c7d5e53e7bc to before 6e152cbfac3a2a62f79df7d23d621917c20367ebAffected
  • 22d8de62f11b287b279f1d4473a78c7d5e53e7bc to before 3b8a540b36aa064822c701e4e0a1dea2cd4ec5b0Affected
  • 22d8de62f11b287b279f1d4473a78c7d5e53e7bc to before 3d20cd049fc5f51f80e24a2db7a3cf00593c79e4Affected
  • 22d8de62f11b287b279f1d4473a78c7d5e53e7bc to before 2f0c97b1a32fba8e81a69f6231aa0b3c9b6bc581Affected
  • 22d8de62f11b287b279f1d4473a78c7d5e53e7bc to before 18c08f84ca483029f04e426ec7ca3b5d3684cf22Affected
  • 22d8de62f11b287b279f1d4473a78c7d5e53e7bc to before 74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11Affected
LinuxLinux
  • 5.13Affected
  • before 5.13Not affected
  • 6.1.188 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.110 through 6.12.*Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.