CVE-2014-4654: Canonical Ubuntu Linux

Medium severity, CVSS 4.6. EPSS: 0.5% chance of exploitation in the next 30 days.

The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call.

Affected products

• Canonical Ubuntu Linux: version 12.04 only
• Linux Linux Kernel: before 3.15.2 (fixed in 3.15.2)
• Suse Linux Enterprise Server: version 10 only

Published 2014-07-03. Last modified 2026-06-17.