This update for alsa fixes the following issues:
- CVE-2026-96674: computation of combined topology element size using 32-bit arithmetic in `src/topology/ctl.c` allows
for integer overflow that can cause sensitive data leak and application crashes (bsc#1282564).
- CVE-2026-96675: failure to validate sparse binding indices before array access when processing ALSA configuration
files can lead to an assertion failure and an application abort (bsc#1282563).
This update for alsa fixes the following issue
- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that can allow attackers to corrupt memory
(bsc#1268853).