In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB array access at reading cache find_control() to… (CVE-2026-64133)

The Linux kernel ALSA asihpi driver contained a vulnerability where the find_control() function accessed an array using an unchecked index from a cached info structure, potentially causing an out-of-bounds array access. This could lead to memory corruption or exposure of sensitive information. The issue was fixed by adding a sanity check to validate the index before accessing the array. The vulnerability is tracked as CVE-2026-64133 with a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The fix is included in Linux kernel updates for affected Ubuntu versions prior to 5.15.0-1112.119~20.04.1 and related builds. The Ubuntu security advisories USN-8575-1 and USN-8576-1 provide detailed patch information and recommend updating to the fixed kernel versions.

Successful exploitation of this vulnerability could allow a local attacker with low privileges to cause out-of-bounds memory access, potentially leading to exposure of sensitive kernel memory, corruption of kernel data structures, and full compromise of system confidentiality, integrity, and availability. The CVSS vector indicates high impact on confidentiality, integrity, and availability, requiring local access with low complexity and no user interaction.

A patch is available and users should update their Linux kernel to the fixed versions as specified in the Ubuntu security advisories USN-8575-1 and USN-8576-1. After applying the update, a system reboot is required to activate the fixes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow the vendor's update instructions carefully to ensure full remediation.