CVE-2026-53241
Received Received - Intake
ALSA: seq: dummy UMP event stack overread vulnerability

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: dummy: fix UMP event stack overread The dummy sequencer port forwards events by copying an incoming struct snd_seq_event into a stack temporary, rewriting source and destination, and dispatching the temporary to subscribers. That legacy event storage is smaller than struct snd_seq_ump_event. When a UMP event reaches the dummy client, the copy leaves the UMP flag set but only provides legacy-sized stack storage. The subscriber delivery path then uses snd_seq_event_packet_size() and copies a UMP-sized packet from that stack object, reading past the end of the temporary. Use the existing union __snd_seq_event storage and copy the packet size reported for the incoming event before rewriting the common routing fields. This preserves the full UMP packet for UMP events while keeping legacy event handling unchanged.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-53241
EUVD
EUVD-2026-39192
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's ALSA sequencer dummy port. The dummy sequencer port forwards events by copying an incoming event structure into a smaller stack temporary buffer. However, when a UMP (Universal MIDI Packet) event is processed, the copy operation leaves the UMP flag set but only allocates legacy-sized storage, which is smaller than the actual UMP event size. As a result, when the event is delivered to subscribers, the system copies a UMP-sized packet from this smaller buffer, causing a stack overread—reading beyond the allocated memory.

The fix involves using a union that can store the full event size and copying the entire packet size before rewriting routing fields. This preserves the full UMP packet and prevents the overread while maintaining legacy event handling.

Impact Analysis

This vulnerability can lead to a stack overread in the Linux kernel when processing certain MIDI events. Such an overread may cause information leakage or potentially lead to system instability or crashes if exploited. It could be used by an attacker to read unintended memory areas, which might contain sensitive information or cause denial of service.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53241. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart