CVE-2026-90781

The ALSA Project's alsa-lib library, through version 1.2.16.1, contains an off-by-one stack buffer overflow (CWE-193) in the __snd_ctl_ascii_elem_id_parse() function: when parsing a control-element identifier whose name= field is 64 or more characters, it writes a single byte past a 64-byte stack buffer. The flaw is triggered when a calling program parses an attacker-supplied string, such as a malicious saved ALSA state file loaded via tools like alsactl restore, or an overly long control-element name passed as a command-line argument to utilities such as amixer. The overflow can corrupt adjacent stack memory and crash the calling process; given the one-byte write scope and the CVSS 4.0 base score of 4.8 (local attack vector, privileges required, low integrity and availability impact, no confidentiality impact), denial of service is the realistic outcome and reliable code execution is unlikely. Virtually any Linux system using the standard ALSA user-space library is affected, though exploitation requires local access and privileges on the target. A public proof-of-concept exists on GitHub, but the flaw is not listed in CISA's KEV catalog and there is no evidence of real-world exploitation.

What to do: Upgrade to a patched alsa-lib package as soon as your distribution ships one newer than 1.2.16.1, and track your vendor's security advisories for the fix. In the meantime, ensure saved ALSA state files (e.g., /var/lib/alsa/asound.state) are root-owned and not writable by untrusted local users, and do not feed untrusted control-element identifier strings to ALSA utilities such as alsactl or amixer. Because the flaw is local, requires privileges, and primarily causes a crash, it can be handled through routine patching rather than emergency measures.