CVE-2026-74640: Linux Kernel Out-of-Bounds Write in FCP Meter Control

The ALSA FCP driver for Focusrite interfaces exposes a meter control. Its read handler writes one 64-bit value per channel into the control value structure without checking the channel count against the structure's capacity. The structure holds 128 values; a meter map larger than that writes past the end of the kmalloc-2048 allocation.

A local user with access to the ALSA control device supplies an oversized meter map and overwrites adjacent slab objects. The CVE carries a CVSS score of 7.8. The fix bounds the write to the array size.