What is the CVSS score of EUVD-2026-48834?

EUVD-2026-48834 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux are affected by EUVD-2026-48834?

A high-severity vulnerability in the Linux kernel's ALSA virtio sound driver affects virtualized environments, where a compromised hypervisor can corrupt guest memory.. A patch is available.

How to fix or mitigate EUVD-2026-48834?

Within 24 hours, identify all systems running Linux kernels with CONFIG_SND_VIRTIO enabled and verify whether the installed kernel version is affected. Within 7 days, apply the vendor-released patch to remediate the vulnerability, prioritizing production virtualization hosts. Within 30 days, confirm patch deployment across all endpoints and conduct a compliance review to ensure no unpatched systems remain.

Linux EUVD-2026-48834

| CVE-2026-64490 HIGH

2026-07-25 Linux

GHSA-4qj6-j88p-jqg9

Buffer Overflow Linux

8.4

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 06:01 vuln.today

CVSS changed

Jul 27, 2026 - 05:22 NVD

8.4 (HIGH)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:51 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 25, 2026 - 08:51 cve.org

HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ALSA: virtio: Validate control metadata from the device

virtio-snd control handling trusts the device-provided control type and value count returned by the device.

That metadata is then used directly to index g_v2a_type_map[] in virtsnd_kctl_info(), and to size loops and memcpy() operations in virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size virtio_snd_ctl_value and snd_ctl_elem_value arrays.

A buggy or malicious device can therefore trigger out-of-bounds access by advertising an invalid control type or an oversized value count.

Validate control type and count once in virtsnd_kctl_parse_cfg(), before querying enumerated items or exposing the control to ALSA.

AnalysisAI

Out-of-bounds read/write in the Linux kernel's ALSA virtio sound driver allows a malicious hypervisor to corrupt guest memory, potentially leading to code execution or information disclosure. Affected are Linux kernel versions with the CONFIG_SND_VIRTIO option enabled, where the driver trusts device-supplied control metadata without validation. Exploitation requires a compromised or malicious host with local access to the virtualized guest; no public exploit or active exploitation has been identified.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-48834 vulnerability details – vuln.today

Back

Linux EUVD-2026-48834

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code