From 66d06f3bdebe2da7b7f6615c65a96c138686fafa Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Fri, 20 Feb 2026 21:54:28 +0100 Subject: [PATCH] alsa-lib: patch CVE-2026-25068 Pick patch mentioned in NVD report. It also includes CVE ID in commit message. Use older SNDERR funtion as new one is not yet available. This was copied from Debian patch. (From OE-Core rev: 2bcdcd8471d9769eaf9304809d9b8e0893cae8e0) Signed-off-by: Peter Marko Signed-off-by: Fabien Thomas Signed-off-by: Yoann Congal Signed-off-by: Paul Barker --- .../alsa/alsa-lib/CVE-2026-25068.patch | 34 +++++++++++++++++++ .../alsa/alsa-lib_1.2.6.1.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch diff --git a/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch b/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch new file mode 100644 index 0000000000..edc22fd62b --- /dev/null +++ b/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch @@ -0,0 +1,34 @@ +From 5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40 Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Thu, 29 Jan 2026 16:51:09 +0100 +Subject: [PATCH] topology: decoder - add boundary check for channel mixer + count + +Malicious binary topology file may cause heap corruption. + +CVE: CVE-2026-25068 + +Signed-off-by: Jaroslav Kysela + +Upstream-Status: Backport [https://github.com/alsa-project/alsa-lib/commit/5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40] +Signed-off-by: Peter Marko +--- + src/topology/ctl.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/topology/ctl.c b/src/topology/ctl.c +index a0c24518..322c461c 100644 +--- a/src/topology/ctl.c ++++ b/src/topology/ctl.c +@@ -1246,6 +1246,11 @@ int tplg_decode_control_mixer1(snd_tplg_t *tplg, + if (mc->num_channels > 0) { + map = tplg_calloc(heap, sizeof(*map)); + map->num_channels = mc->num_channels; ++ if (map->num_channels > SND_TPLG_MAX_CHAN || ++ map->num_channels > SND_SOC_TPLG_MAX_CHAN) { ++ SNDERR("mixer: unexpected channel count %d", map->num_channels); ++ return -EINVAL; ++ } + for (i = 0; i < map->num_channels; i++) { + map->channel[i].reg = mc->channel[i].reg; + map->channel[i].shift = mc->channel[i].shift; diff --git a/meta/recipes-multimedia/alsa/alsa-lib_1.2.6.1.bb b/meta/recipes-multimedia/alsa/alsa-lib_1.2.6.1.bb index ca6bedae97..8c91863ad1 100644 --- a/meta/recipes-multimedia/alsa/alsa-lib_1.2.6.1.bb +++ b/meta/recipes-multimedia/alsa/alsa-lib_1.2.6.1.bb @@ -10,6 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=a916467b91076e631dd8edb7424769c7 \ " SRC_URI = "https://www.alsa-project.org/files/pub/lib/${BP}.tar.bz2" +SRC_URI += "file://CVE-2026-25068.patch" SRC_URI[sha256sum] = "ad582993d52cdb5fb159a0beab60a6ac57eab0cc1bdf85dc4db6d6197f02333f" inherit autotools pkgconfig