Linux Kernel CVE-2026-53241

The ALSA (Advanced Linux Sound Architecture) sequencer subsystem includes a dummy sequencer client (snd_seq_dummy) that forwards events by copying an incoming struct snd_seq_event into a stack-allocated temporary, rewriting the source and destination routing fields, and dispatching to subscribers. The root cause is a size mismatch between the legacy struct snd_seq_event and the newer struct snd_seq_ump_event (Universal MIDI Packet support added upstream): the dummy client allocates only legacy-sized stack storage, but when a UMP event arrives the UMP flag is preserved in the copy. The subscriber delivery path subsequently calls snd_seq_event_packet_size() on that stack object, receives the larger UMP packet size, and copies that many bytes from the undersized stack allocation - a classic out-of-bounds stack read (analogous to CWE-125). CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* covers all affected stable branches. The fix, introduced at multiple stable-tree commits, switches to the existing union __snd_seq_event storage and copies the full packet size reported for the incoming event before rewriting routing fields, preserving UMP payload integrity without breaking legacy event handling.