{"id":"CVE-2026-90060","revision":"4c836877a3d743cda4e42deed727ef35","records":[{"revision":"4c836877a3d743cda4e42deed727ef35","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90060","aliases":[],"title":"ALSA: control: Don't add invalid kcontrols to LED layer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: control: Don't add invalid kcontrols to LED layer\n\nThe kcontrol LED state layer tries to track the all associated\nkcontrol elements with naive assumptions that they are readable.\nBut one can create a write-only element that has no get callback (even\na user element can do it), and this may lead to a NULL dereference at\nthe call chain of snd_ctl_led_notify(), as found by syzkaller.\n\nFor avoiding the Oops, add a sanity check of the kcontrol's info and\nget callbacks, and just skip the invalid kcontrols before assigning\nthe kctl to the LED layer.","state":0,"publishedAt":"2026-09-17T16:05:44.515+00:00","modifiedAt":"2026-10-21T12:49:38.739+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"sound/core/control_led.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"22d8de62f11b287b279f1d4473a78c7d5e53e7bc\",\n                            \"lessThan\": \"6e152cbfac3a2a62f79df7d23d621917c20367eb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"22d8de62f11b287b279f1d4473a78c7d5e53e7bc\",\n                            \"lessThan\": \"3b8a540b36aa064822c701e4e0a1dea2cd4ec5b0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"22d8de62f11b287b279f1d4473a78c7d5e53e7bc\",\n                            \"lessThan\": \"3d20cd049fc5f51f80e24a2db7a3cf00593c79e4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"22d8de62f11b287b279f1d4473a78c7d5e53e7bc\",\n                            \"lessThan\": \"2f0c97b1a32fba8e81a69f6231aa0b3c9b6bc581\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"22d8de62f11b287b279f1d4473a78c7d5e53e7bc\",\n                            \"lessThan\": \"18c08f84ca483029f04e426ec7ca3b5d3684cf22\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"22d8de62f11b287b279f1d4473a78c7d5e53e7bc\",\n                            \"lessThan\": \"74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"sound/core/control_led.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/6e152cbfac3a2a62f79df7d23d621917c20367eb","https://git.kernel.org/stable/c/3b8a540b36aa064822c701e4e0a1dea2cd4ec5b0","https://git.kernel.org/stable/c/3d20cd049fc5f51f80e24a2db7a3cf00593c79e4","https://git.kernel.org/stable/c/2f0c97b1a32fba8e81a69f6231aa0b3c9b6bc581","https://git.kernel.org/stable/c/18c08f84ca483029f04e426ec7ca3b5d3684cf22","https://git.kernel.org/stable/c/74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90060","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90060","identifiers":["CVE-2026-90060"]},"retained":false,"historicalAffected":[]}],"coverage":[]}