CVE-2026-74339

Received Received - Intake

Use-After-Free in Linux Kernel ALSA Sequencer

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read snd_seq_read() copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRV_SEQ_EXT_CHAINED internally, and data.ext.ptr points at the first extension cell. The read side strips SNDRV_SEQ_EXT_* bits from data.ext.len before the copy, but it leaves data.ext.ptr untouched. A userspace sequencer client can therefore write a direct variable event to itself and read back the extension-cell kernel address from the returned header. Clear the temporary header pointer before copy_to_user(). The original queued event remains unchanged and is still passed to snd_seq_expand_var_event(), so payload expansion keeps using the internal chain.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74339

EUVD

EUVD-2026-59486

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ALSA sequencer subsystem. When reading queued variable-length events, the kernel copies an event header to userspace before processing the payload. The issue is that a pointer to kernel memory (data.ext.ptr) is left exposed in the header, allowing a userspace client to read this kernel address by crafting a specific event.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA sequencer subsystem and does not have a direct network detection method. Detection requires checking kernel versions and examining kernel memory for exposed pointers. Use uname -a to check kernel version and grep for snd_seq_read in kernel logs or memory dumps.

Impact Analysis

An attacker with access to a userspace sequencer client could exploit this to leak kernel memory addresses. This could aid in further exploits, such as bypassing security mechanisms or escalating privileges. However, it does not directly allow arbitrary code execution or data modification.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to memory exposure in the ALSA sequencer subsystem, not a data privacy or security breach that would impact regulatory compliance.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the snd_seq_read vulnerability. If immediate patching is not possible, disable the ALSA sequencer module using modprobe -r snd-seq or restrict access to /dev/snd/seq via permissions or SELinux policies.

Hi! I’m here to help you understand CVE-2026-74339. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70