The Linux kernel ALSA FCP driver had an out-of-bounds write vulnerability (CVE-2026-74640) in the fcp_meter_ctl_get() function. The vulnerability was due to a mismatch between the user-supplied Level Meter map size limit (255) and the actual integer array size (128) in struct snd_ctl_elem_value. This allowed writes beyond the allocated memory when reading controls, potentially corrupting adjacent memory. The vulnerability requires CAP_SYS_RAWIO to install an oversized map, but any process able to read controls on /dev/snd/controlC0 could trigger the out-of-bounds write. The fix involved bounding the map size by the ABI limit and adding bounds checks to prevent out-of-bounds writes regardless of elem->channels value.

The out-of-bounds write could lead to memory corruption in kernel space, potentially causing system instability or crashes. Since the vulnerability requires CAP_SYS_RAWIO to install an oversized map, exploitation requires elevated privileges initially, but the out-of-bounds write can be triggered by any process able to read the affected controls. No known exploits in the wild have been reported. The vulnerability was detected by KASAN, indicating a serious memory safety issue.

A fix is available that bounds the map size by the ABI limit and adds proper bounds checking in the fcp_meter_ctl_get() function to prevent out-of-bounds writes. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel vulnerability, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation.