CVE-2026-90781: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-90781 is an off-by-one stack buffer overflow in the Advanced Linux Sound Architecture library (alsa-lib) affecting all versions through 1.2.16.1. The flaw resides in the __snd_ctl_ascii_elem_id_parse() function in src/control/ctlparse.c, where the boundary check size < (int)sizeof(buf) allows one byte to be written past the end of a 64-byte stack buffer when a name= field contains 64 or more characters. It was disclosed and patched on September 13, 2026. The CVSS v3.1 base score is 4.4 (Medium) and the CVSS v4.0 base score is 4.8 (Medium) (Github Advisory, Feedly).

The root cause is an off-by-one error (CWE-193) in the __snd_ctl_ascii_elem_id_parse() function within src/control/ctlparse.c (lines 216–241 in v1.2.16.1). The vulnerable condition if (size < (int)sizeof(buf)) permits writing exactly one byte beyond the 64-byte stack buffer buf when the input name string is exactly 64 characters long, because the null terminator is subsequently written at buf[64] — one position past the buffer boundary. The fix, applied in commit f84cd4c, changes the condition to if (size < (int)sizeof(buf) - 1) to reserve space for the null terminator. Exploitation requires a local attacker with low privileges to supply a crafted control-element identifier string via ALSA saved state files (e.g., asound.state) or command-line arguments to tools that invoke this parsing function (alsa-lib commit, Github Advisory).

Successful exploitation allows a local low-privileged attacker to overwrite one byte of adjacent stack memory, most likely causing the calling process to crash (denial of service). Minor integrity impact is possible if the overwritten byte influences program control flow in a meaningful way, though reliable code execution is considered unlikely given the single-byte nature of the overflow. There is no confidentiality impact, and the vulnerability does not affect subsequent systems or enable lateral movement (Github Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, reflecting negligible near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The local-only attack vector and low-privilege requirement significantly limit the attack surface, making opportunistic exploitation unlikely in most environments.

1. Identify a target: Locate a Linux system running alsa-lib version 1.2.16.1 or earlier that processes ALSA control-element identifiers from user-controlled input (e.g., via alsactl restore or a similar utility).
2. Craft a malicious input: Prepare a control-element identifier string with a name= field of exactly 64 or more characters (e.g., iface=MIXER,name='AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA').
3. Deliver the payload: Place the crafted string into an ALSA saved state file (e.g., /etc/asound.state or a user-writable state file) or pass it as a command-line argument to a tool that calls __snd_ctl_ascii_elem_id_parse().
4. Trigger parsing: Cause the target application or service to parse the malicious state file (e.g., by running alsactl restore or restarting a service that reads ALSA state), triggering the one-byte stack overflow.
5. Observe impact: The calling process crashes due to stack corruption, achieving a denial-of-service condition (alsa-lib commit, Github Advisory).

• File System: Unexpected modifications to ALSA state files (e.g., /etc/asound.state, ~/.asoundrc) containing name= fields with strings of 64 or more characters.
• Logs: Application crash logs or core dumps from processes that invoke alsactl, alsamixer, or other ALSA utilities; segmentation fault entries in system logs (/var/log/syslog, journalctl) referencing ALSA-related processes.
• Process: Unexpected termination (SIGSEGV or SIGABRT) of audio-related daemons or applications that parse ALSA control-element identifiers.

The fix is available in the alsa-lib repository as commit f84cd4ced7b36fddb8e4ee24404cf7c091d27020; users should update to any version of alsa-lib built from this commit or later. Until a patched release is available from distribution maintainers, restrict write access to ALSA state files (e.g., /etc/asound.state) to trusted users only, and avoid processing untrusted control-element identifier strings via command-line tools. Monitor distribution-specific package updates (e.g., from Debian, Ubuntu, Fedora, Arch) for a patched alsa-lib package (alsa-lib commit, Github Advisory).

The vulnerability was reported to the ALSA development mailing list by Harsh Raj Singhania and acknowledged by maintainer Jaroslav Kysela, who committed the fix (alsa-lib commit). VulnCheck assigned the CVE and published an advisory. Community reaction has been minimal given the low severity and local-only attack vector.