The ALSA mpu401 driver in the Linux kernel did not validate the card index (devptr->id) during probe, assuming it was always within a valid range. While this assumption held for devices created at module probe time, manually bound devices via sysfs could have an index of -1 (none), causing out-of-bounds access to internal arrays such as index[]. The fix introduces a sanity check to validate and correct the card index, preventing OOB access.

This vulnerability could lead to out-of-bounds memory access in the kernel, potentially causing system instability or crashes. There is no information about exploitation in the wild or further impact such as privilege escalation. The issue arises only when devices are manually bound via sysfs with an invalid card index.

A fix has been implemented in the Linux kernel to add a sanity check for the card index in the ALSA mpu401 driver. Users should update to the fixed kernel version once available. No additional mitigation steps are indicated.