CVE-2026-90060

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

ALSA: control: Don’t add invalid kcontrols to LED layer

The kcontrol LED state layer tries to track the all associated kcontrol elements with naive assumptions that they are readable. But one can create a write-only element that has no get callback (even a user element can do it), and this may lead to a NULL dereference at the call chain of snd_ctl_led_notify(), as found by syzkaller.

For avoiding the Oops, add a sanity check of the kcontrol’s info and get callbacks, and just skip the invalid kcontrols before assigning the kctl to the LED layer.

Affected product:

AlmaLinux 9.2 ESU , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU

Affected packages:

kernel @ 5.14.0 (+5 more)

Live-patch status from KernelCare for each operating system.