new file mode 100644
@@ -0,0 +1,68 @@
+From f8253a68baf9a5f57cdff1cd178920d13e5beb2b Mon Sep 17 00:00:00 2001
+From: Harsh Raj Singhania <raj.harshraut@gmail.com>
+Date: Thu, 1 Oct 2026 00:28:15 +0530
+Subject: [PATCH] topology: fix uint32_t overflow in control decoder size
+ checks
+
+size2 = x->size + x->priv.size was computed in 32-bit arithmetic and could
+wrap on a 64-bit host, bypassing the subsequent bounds check. Pre-check
+for overflow then cast to size_t. Affects tplg_decode_control_mixer,
+tplg_decode_control_enum, and tplg_decode_control_bytes.
+
+Closes: https://github.com/alsa-project/alsa-lib/pull/527
+Signed-off-by: Harsh Raj Singhania <raj.harshraut@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+CVE: CVE-2026-96674
+Upstream-Status: Backport [https://github.com/alsa-project/alsa-lib/commit/f8253a68baf9a5f57cdff1cd178920d13e5beb2b]
+Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp>
+---
+ src/topology/ctl.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/src/topology/ctl.c b/src/topology/ctl.c
+index 322c461c..93a09f1e 100644
+--- a/src/topology/ctl.c
++++ b/src/topology/ctl.c
+@@ -1315,7 +1315,12 @@ next:
+ }
+ INIT_LIST_HEAD(&heap);
+ mc = bin;
+- size2 = mc->size + mc->priv.size;
++ if (mc->priv.size > size || mc->size > size - mc->priv.size) {
++ snd_error(TOPOLOGY, "mixer: element sizes overflow (%d, priv %d)",
++ mc->size, mc->priv.size);
++ return -EINVAL;
++ }
++ size2 = (size_t)mc->size + (size_t)mc->priv.size;
+ if (size2 > size) {
+ snd_error(TOPOLOGY, "mixer: wrong element size (%d, priv %d)",
+ mc->size, mc->priv.size);
+@@ -1419,7 +1424,12 @@ next:
+ }
+ INIT_LIST_HEAD(&heap);
+ ec = bin;
+- size2 = ec->size + ec->priv.size;
++ if (ec->priv.size > size || ec->size > size - ec->priv.size) {
++ snd_error(TOPOLOGY, "enum: element sizes overflow (%d, priv %d)",
++ ec->size, ec->priv.size);
++ return -EINVAL;
++ }
++ size2 = (size_t)ec->size + (size_t)ec->priv.size;
+ if (size2 > size) {
+ snd_error(TOPOLOGY, "enum: wrong element size (%d, priv %d)",
+ ec->size, ec->priv.size);
+@@ -1510,7 +1520,12 @@ next:
+ return -EINVAL;
+ }
+ bc = bin;
+- size2 = bc->size + bc->priv.size;
++ if (bc->priv.size > size || bc->size > size - bc->priv.size) {
++ snd_error(TOPOLOGY, "bytes: element sizes overflow (%d, priv %d)",
++ bc->size, bc->priv.size);
++ return -EINVAL;
++ }
++ size2 = (size_t)bc->size + (size_t)bc->priv.size;
+ if (size2 > size) {
+ snd_error(TOPOLOGY, "bytes: wrong element size (%d, priv %d)",
+ bc->size, bc->priv.size);
new file mode 100644
@@ -0,0 +1,45 @@
+From 81c4a89eb445f8e991ca80ab55b5649530c0aacd Mon Sep 17 00:00:00 2001
+From: Harsh Raj Singhania <raj.harshraut@gmail.com>
+Date: Thu, 1 Oct 2026 00:28:53 +0530
+Subject: [PATCH] pcm: replace multi plugin binding asserts with -EINVAL checks
+
+Sparse binding maps leave sidxs[i] == -1 for gap indices. The previous
+assert() calls caused SIGABRT in debug builds and OOB reads under NDEBUG.
+Return -EINVAL with explicit bounds and sign checks instead.
+
+[ fixed coding style -- tiwai ]
+
+Closes: https://github.com/alsa-project/alsa-lib/pull/527
+Signed-off-by: Harsh Raj Singhania <raj.harshraut@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+CVE: CVE-2026-96675
+Upstream-Status: Backport [https://github.com/alsa-project/alsa-lib/commit/81c4a89eb445f8e991ca80ab55b5649530c0aacd]
+Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp>
+---
+ src/pcm/pcm_multi.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/src/pcm/pcm_multi.c b/src/pcm/pcm_multi.c
+index 121c4c20..c7c67e73 100644
+--- a/src/pcm/pcm_multi.c
++++ b/src/pcm/pcm_multi.c
+@@ -1121,8 +1121,16 @@ int snd_pcm_multi_open(snd_pcm_t **pcmp, const char *name,
+ }
+ for (i = 0; i < channels_count; ++i) {
+ snd_pcm_multi_channel_t *bind = &multi->channels[i];
+- assert(sidxs[i] < (int)slaves_count);
+- assert(schannels[i] < schannels_count[sidxs[i]]);
++ if (sidxs[i] < 0 || sidxs[i] >= (int)slaves_count) {
++ SNDERR("multi: ch %d invalid slave idx %d",
++ i, sidxs[i]);
++ return -EINVAL;
++ }
++ if (schannels[i] >= schannels_count[sidxs[i]]) {
++ SNDERR("multi: ch %d channel %d out of range",
++ i, schannels[i]);
++ return -EINVAL;
++ }
+ bind->slave_idx = sidxs[i];
+ bind->slave_channel = schannels[i];
+ if (sidxs[i] < 0)
@@ -11,6 +11,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=a916467b91076e631dd8edb7424769c7 \
SRC_URI = "https://www.alsa-project.org/files/pub/lib/${BP}.tar.bz2 \
file://CVE-2026-90781.patch \
+ file://CVE-2026-96674.patch \
+ file://CVE-2026-96675.patch \
"
SRC_URI[sha256sum] = "f740db7f488255944ffd4428416ee3390a96742856916433df468c281436480e"