CVE-2026-74339ALSA: seq: Clear variable event pointer on read
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read snd_seq_read() copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRV_SEQ_EXT_CHAINED internally, and data.ext.ptr points at the first extension cell. The read side strips SNDRV_SEQ_EXT_* bits from data.ext.len before the copy, but it leaves data.ext.ptr untouched. A userspace sequencer client can therefore write a direct variable event to itself and read back the extension-cell kernel address from the returned header. Clear the temporary header pointer before copy_to_user(). The original queued event remains unchanged and is still passed to snd_seq_expand_var_event(), so payload expansion keeps using the internal chain.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 14fe4f75fd5309d6b75f8e840ada88912b374207; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f29243c211928114f8b906e0a3fee77c236f14c8; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before e0c3edd86414534cfd179fefe45b38c29c01ae7a; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 6b52211eba213c461f68922708a99d8190c1fcd5; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 74ac1ce1f4afdb3b80b6742fa28fb86c8c51d31b; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c2ac9287e89916da684c2a548798351e63eb59ee; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 705dd6dcbc0ea87351c660c1a6443f85f1001c76 | CNA record |
References
- https://git.kernel.org/stable/c/14fe4f75fd5309d6b75f8e840ada88912b374207
- https://git.kernel.org/stable/c/f29243c211928114f8b906e0a3fee77c236f14c8
- https://git.kernel.org/stable/c/e0c3edd86414534cfd179fefe45b38c29c01ae7a
- https://git.kernel.org/stable/c/6b52211eba213c461f68922708a99d8190c1fcd5
- https://git.kernel.org/stable/c/74ac1ce1f4afdb3b80b6742fa28fb86c8c51d31b
- https://git.kernel.org/stable/c/c2ac9287e89916da684c2a548798351e63eb59ee
- https://git.kernel.org/stable/c/705dd6dcbc0ea87351c660c1a6443f85f1001c76
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.