EUVD-2026-59534
GHSA-wp68-7ghh-v4rv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition exploitation requires precise thread timing, warranting AC:H over NVD's AC:L; all other metrics match the confirmed local, low-privilege, kernel-impact scenario.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: midi: Serialize output teardown with event_input
event_process_midi() borrows msynth->output_rfile.output and then passes the substream to dump_midi() and snd_rawmidi_kernel_write() without synchronizing with the output open/close transition. midisynth_use() also publishes output_rfile before snd_rawmidi_output_params() has finished.
The last midisynth_unuse() can therefore release the same rawmidi file and free substream->runtime before snd_rawmidi_kernel_write1() takes its runtime buffer reference. That leaves the event_input path using a stale substream or runtime and can end in a NULL-deref or use-after-free.
Fix this with two pieces of synchronization. Keep a short IRQ-safe spinlock only for publishing or clearing output_rfile and for pairing the output snapshot with an snd_use_lock_t reference. Once event_process_midi() has taken that in-flight reference, it drops the spinlock before calling snd_seq_dump_var_event(), dump_midi(), or snd_rawmidi_kernel_write(). midisynth_unuse() now detaches the visible rawmidi file under the same spinlock, waits for the in-flight writers to drain, and only then drains and releases the saved file. midisynth_use() likewise opens into a local snd_rawmidi_file and publishes it only after snd_rawmidi_output_params() succeeds.
The buggy scenario involves two paths, with each column showing the order within that path:
event_input path: last unuse path:
- event_process_midi() snapshots 1. midisynth_unuse() starts
output_rfile.output. tearing down output_rfile.
- dump_midi() reaches 2. snd_rawmidi_kernel_release()
snd_rawmidi_kernel_write() closes the output file. before runtime is pinned. 3. close_substream() frees
- The callback keeps using substream->runtime.
the borrowed substream.
Validation reproduced this kernel report: KASAN null-ptr-deref in snd_rawmidi_kernel_write1+0x56/0x360 RIP: 0033:0x7fde7dd0837f RIP: 0010:snd_rawmidi_kernel_write1+0x56/0x360
AnalysisAI
Use-after-free and NULL-pointer dereference in the Linux kernel ALSA sequencer MIDI subsystem allows a local low-privileged user to crash the kernel or potentially escalate privileges by racing MIDI output event processing against port teardown. The flaw exists because event_process_midi() reads msynth->output_rfile.output without holding any lock, while midisynth_unuse() can concurrently free substream->runtime before snd_rawmidi_kernel_write1() pins its buffer reference - leaving the event path with a dangling pointer confirmed via KASAN null-ptr-deref reproduction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local user account with read/write access to the ALSA sequencer device (`/dev/snd/seq`, typically accessible to members of the `audio` group on desktop Linux systems). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects local exploitability and kernel-level impact but may overstate practical ease: AC:L does not capture the precise timing window required to win a race between two independent kernel threads - real-world reliable exploitation is harder than AC:L implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with a low-privileged account spawns two concurrent threads: one continuously writes MIDI events to a synthesizer output port via the ALSA sequencer interface, and the other rapidly opens and closes the same port, triggering `midisynth_unuse()`. When the teardown thread wins the race - freeing `substream->runtime` between the moment the event thread reads `output_rfile.output` and the moment `snd_rawmidi_kernel_write1()` pins the runtime buffer - the event thread dereferences a freed or NULL kernel pointer, triggering a crash (denial of service) or, on kernels without SMEP/SMAP mitigations or with heap layout control, potential privilege escalation. … |
| Remediation | The primary fix is to upgrade to a patched kernel version: 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1, via upstream stable commits referenced at https://git.kernel.org/stable/c/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all ALSA-enabled Linux systems in your environment and determine kernel versions requiring patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today