Linux Kernel CVE-2026-74640

Phase 1 (setup, privileged): CAP_SYS_RAWIO capability is required to call fcp_ioctl_set_meter_map() and install a Level Meter map with map_size between 129 and 255. A compatible FireWire audio interface must be present and the snd-fcp kernel module must be loaded. Phase 2 (trigger, unprivileged): Once the oversized control exists in the ALSA control tree, any process with read access to /dev/snd/controlC0 can trigger the OOB write by issuing a standard ALSA control read - no elevated privileges are required for this phase. The control persists across closure of the hwdep file descriptor, decoupling setup from trigger. Key limiting factors: FireWire audio hardware must be physically present and the driver loaded; exploitation is confirmed on LP64 architectures (arm64 verified via KASAN, x86_64 structurally identical); the OOB write content is partially influenced by device responses and meter_level_map[] configuration set during Phase 1.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the local, low-privilege trigger phase: once an oversized FCP meter control exists on the system, any unprivileged process opening /dev/snd/controlC0 for a routine control read will issue the OOB writes. The two-stage attack structure is the key nuance - the setup phase requires CAP_SYS_RAWIO, which is a meaningful barrier absent from the CVSS score, so raw CVSS overstates autonomous reachability. EPSS at 0.21% (11th percentile) reflects the community's low near-term exploitation expectation, consistent with the specialized hardware dependency (FireWire audio interface required) and the privilege prerequisite for the setup stage. No CISA KEV entry exists, confirming no known active exploitation at time of analysis. The KASAN trace from arm64 7.2.0-rc5 confirms the corruption is real and demonstrable. In practice, even a mid-sized municipal IT team in rybnik running Linux on standard x86 servers without FireWire audio hardware faces essentially zero exposure, since snd-fcp will not be loaded. For environments specifically running professional FireWire audio workstations, the two-stage nature still requires an initial privileged action, limiting automated exploitation paths. The heap corruption extent (888 bytes, with content partially controlled via meter_level_map[]) provides strong primitives for further exploitation once triggered.

A local attacker or compromised privileged process with CAP_SYS_RAWIO opens the FCP hwdep device and calls fcp_ioctl_set_meter_map() with map_size set to 200, persisting a malformed ALSA control. After closing the hwdep descriptor, any subsequent unprivileged process - such as a sound server daemon running as a low-privilege user - performs a routine ALSA control enumeration on /dev/snd/controlC0, triggering fcp_meter_ctl_get() to write 1600 bytes starting at offset 72 of a 1224-byte allocation, corrupting 376 bytes of an adjacent slab object and potentially enabling privilege escalation through controlled heap layout manipulation.