ALAS2023-2026-3429

References: CVE-2026-90781  CVE-2026-96675 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process. (CVE-2026-90781)

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort. (CVE-2026-96675)

Issue Correction:
Run dnf update alsa-lib --releasever 2023.12.20261112 or dnf update --advisory ALAS2023-2026-3429 --releasever 2023.12.20261112 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    alsa-lib-debuginfo-1.2.7.2-1.amzn2023.0.5.aarch64
    alsa-lib-1.2.7.2-1.amzn2023.0.5.aarch64
    alsa-lib-debugsource-1.2.7.2-1.amzn2023.0.5.aarch64
    alsa-lib-devel-1.2.7.2-1.amzn2023.0.5.aarch64

noarch:
    alsa-topology-1.2.7.2-1.amzn2023.0.5.noarch
    alsa-ucm-1.2.7.2-1.amzn2023.0.5.noarch

src:
    alsa-lib-1.2.7.2-1.amzn2023.0.5.src

x86_64:
    alsa-lib-devel-1.2.7.2-1.amzn2023.0.5.x86_64
    alsa-lib-debugsource-1.2.7.2-1.amzn2023.0.5.x86_64
    alsa-lib-1.2.7.2-1.amzn2023.0.5.x86_64
    alsa-lib-debuginfo-1.2.7.2-1.amzn2023.0.5.x86_64