Linux vulnerability

What happened

In the Linux kernel, the following vulnerability has been resolved: ALSA: mts64: Check card index validity at probe Although mts64 driver has a check of the given devptr->id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via sysfs. This may lead to OOB access for index[] and other parameters. Add a sanity check for the card index and warn/correct it if it's a value out of the range.

Affected versions

Linux: 68ab801e32bbe2caac8b8c6e6e94f41fe7d687ad through before 036e7aa793375ab16ea0f64b8de6673220416cc1 (git); 68ab801e32bbe2caac8b8c6e6e94f41fe7d687ad through before a4e774eeb61aec64da5b03d3becffde26f7fe4de (git); 68ab801e32bbe2caac8b8c6e6e94f41fe7d687ad through before cf3af453a48c8d905512dfc44a5a59439b70f4f0 (git); 68ab801e32bbe2caac8b8c6e6e94f41fe7d687ad through before d18a260720f86a5f8b5fcfefc4ba2e9dd01c10f8 (git); 2.6.19 Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.