Description
alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ALSA Project | alsa-lib | 1.2.2 – ≤ 1.2.15.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | alsa-lib | 1.2.16-1 | — |
| Debian 13 | alsa-lib | 1.2.14-1+deb13u1 | — |
| Debian 12 | alsa-lib | No fix yet | — |
| Debian 11 | alsa-lib | 1.2.4-1.1+deb11u1 | DLA-4469-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | alsa-lib | 1.2.15.3-1ubuntu1 | — |
| Ubuntu 25.10 | alsa-lib | 1.2.14-1ubuntu1.1 | USN-8044-1 |
| Ubuntu 24.04 LTS | alsa-lib | 1.2.11-1ubuntu0.2 | USN-8044-1 |
| Ubuntu 22.04 LTS | alsa-lib | 1.2.6.1-1ubuntu1.1 | USN-8044-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | alsa-lib | 1.2.2-2.1ubuntu2.5+esm1 | USN-8044-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | alsa-lib +1 | 1.2.15.3-3.1.hum1 | RHSA-2026:7401 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | alsa-lib +3 | 1.2.7.2-1.amzn2023.0.3 | ALAS2023-2026-1426 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | alsa-lib | 1.2.9-2 | — |
| Azure Linux 2 (CBL-Mariner) | alsa-lib | 1.2.6.1-3 | — |
Advisories 5
- RHSA-2026:7401 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- USN-8044-2 alsa-lib vulnerability Ubuntu Security Notices (USN) · Jun 9, 2026
- USN-8044-1 alsa-lib vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- ALAS2023-2026-1426 Moderate: alsa-lib security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 18, 2026
- DLA-4469-1 alsa-lib - security update Debian Security (DSA / DLA) · Feb 5, 2026