UnratedFix available
ALSA: portman2x4: Check card index validity at probe
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: ALSA: portman2x4: Check card index validity at probe Although portman2x4 driver has a check of the given devptr->id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via sysfs. This may lead to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.270, 5.15.221, 6.1.188, 6.12.109, 6.18.50, 6.6.157, 7.2.4
- CVEs
- CVE-2026-80966
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 14:34 UTC · Revision 1
Source evidence
ALSA: portman2x4: Check card index validity at probe
core-osv · Original sourcePublished 11 Sept 2026, 19:42 UTC
In the Linux kernel, the following vulnerability has been resolved: ALSA: portman2x4: Check card index validity at probe Although portman2x4 driver has a check of the given devptr->id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via sysfs. This may lead to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range.
osv:CVE-2026-80966
Kernel
Fixed versions: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4
Complete source record
{
"id": "50f45c9d7e7a8e22134ea6cb087f49beaf70c608904412c2c1d119e20c9977bc",
"url": "https://osv.dev/vulnerability/CVE-2026-80966",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALSA: portman2x4: Check card index validity at probe",
"summary": "In the Linux kernel, the following vulnerability has been resolved: ALSA: portman2x4: Check card index validity at probe Although portman2x4 driver has a check of the given devptr->id value, it doesn't check for a negative id, which is often given as \"none\" or such value when bound via sysfs. This may lead to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range.",
"evidence": "osv:CVE-2026-80966",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.270",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.221",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.188",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.157",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.109",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.50",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.4",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-80966",
"aliases": [
"CVE-2026-80966"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "757e119bf52b014b3181eed97b01f87a245b8ff9"
},
{
"fixed": "45ea0707298798678a60ff861b695aea049a5469"
},
{
"fixed": "5d7ac5e9ee5ba76b567ace13b46075caf79dcca0"
},
{
"fixed": "0048994854f3e9c57b7a754de43ef8da5818d140"
},
{
"fixed": "64898e9bd8b7b229efa8642b85b56b326a6ec3dc"
},
{
"fixed": "0ce391090809d610647f424b9b1dc24aa2c546fd"
},
{
"fixed": "d7ef7890e3e35b4ba09e76fc6b72047a1599a5e8"
},
{
"fixed": "e1ce8ad1009b1736b3044b3324350dcfdd516f42"
},
{
"fixed": "3690ef20469d5959378260e2752f2314a2572913"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80966.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.6.21"
},
{
"fixed": "5.10.270"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.221"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.188"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.157"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.109"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.50"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.2.4"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80966.json"
}
}
],
"modified": "2026-10-28T02:30:29.527725370Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/0048994854f3e9c57b7a754de43ef8da5818d140",
"https://git.kernel.org/stable/c/0ce391090809d610647f424b9b1dc24aa2c546fd",
"https://git.kernel.org/stable/c/3690ef20469d5959378260e2752f2314a2572913",
"https://git.kernel.org/stable/c/45ea0707298798678a60ff861b695aea049a5469",
"https://git.kernel.org/stable/c/5d7ac5e9ee5ba76b567ace13b46075caf79dcca0",
"https://git.kernel.org/stable/c/64898e9bd8b7b229efa8642b85b56b326a6ec3dc",
"https://git.kernel.org/stable/c/d7ef7890e3e35b4ba09e76fc6b72047a1599a5e8",
"https://git.kernel.org/stable/c/e1ce8ad1009b1736b3044b3324350dcfdd516f42",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80966.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-80966",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80966.json"
}
},
"related_cves": [
{
"value": "CVE-2026-80966",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 496413,
"published_at": "2026-09-11T19:42:31.16+00:00"
}