ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-64479
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-25 10:17:33 UTC
Updated2026-07-25 10:17:33 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() snd_seq_event_dup() copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell->ump.raw.extra word that the memcpy() did not cover. The guard deciding whether to clear it compares the copied size against sizeof(cell->event): memcpy(&cell->ump, event, size); if (size < sizeof(cell->event)) cell->ump.raw.extra = 0; For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) == sizeof(cell->event), so the condition is false and the extra word keeps stale data. The cell pool is allocated with kvmalloc() (not zeroed) and cells are reused via a free list, so that word holds uninitialised heap or leftover event data. When such a cell is delivered to a UMP client (client->midi_version > 0) that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it unconverted -- snd_seq_read() reads it out as the larger struct snd_seq_ump_event and copies the stale word to user space, a 4-byte kernel heap infoleak to an unprivileged /dev/snd/seq client. Compare against sizeof(cell->ump) instead, so the trailing word is zeroed for every event shorter than the UMP cell.

Risk And Classification

EPSS: 0.001810000 probability, percentile 0.079690000 (date 2026-07-28)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 6389f2c135311c4ce7c08c3b29145c8f95aacf1f d7649aa11089a93ea2285c210397aa67e5800766 git Not specified
CNA Linux Linux affected d7e2ce72833bb23a82b4201fbed7214cc04a4a8c a224c84e5d3d35708c082c84ad12d81d90762195 git Not specified
CNA Linux Linux affected 46397622a3fa8372b8fda0f04b33d16923b03b1b ea672a9f6cc38f06fe69dd2c257ef8a3d4db179a git Not specified
CNA Linux Linux affected 46397622a3fa8372b8fda0f04b33d16923b03b1b fb1aa5082847b98f44f9c6272aee9d0dca9244f0 git Not specified
CNA Linux Linux affected 46397622a3fa8372b8fda0f04b33d16923b03b1b 651ba82fe2a144bc7356d940bfd235c3810b0549 git Not specified
CNA Linux Linux affected 46397622a3fa8372b8fda0f04b33d16923b03b1b 6ded42615fa1f4949925afd0a8a9e1ab3bf96202 git Not specified
CNA Linux Linux affected 46397622a3fa8372b8fda0f04b33d16923b03b1b 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 git Not specified
CNA Linux Linux affected 6.5 Not specified
CNA Linux Linux unaffected 6.5 semver Not specified
CNA Linux Linux unaffected 6.6.145 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.96 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.39 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.4 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/651ba82fe2a144bc7356d940bfd235c3810b0549 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a224c84e5d3d35708c082c84ad12d81d90762195 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fb1aa5082847b98f44f9c6272aee9d0dca9244f0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6ded42615fa1f4949925afd0a8a9e1ab3bf96202 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ea672a9f6cc38f06fe69dd2c257ef8a3d4db179a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d7649aa11089a93ea2285c210397aa67e5800766 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report