snd_ctl_elem_add in sound/core/control.c in the Linux kernel through 5.6.3 has a count=info->owner typo, which is mishandled in the private_size*count multiplication. CREATE(Triage):(User=admin) [CVE-2020-11725|https://nvd.nist.gov/vuln/detail/CVE-2020-11725]