Linux Kernel CVE-2026-74388

Exploitation requires a local, low-privileged operating system account (CVSS AV:L/PR:L confirmed) with read/write access to the ALSA OSS sequencer device, typically /dev/sequencer or /dev/sequencer2. The snd_seq_oss kernel module must be loaded, which requires that the running kernel was compiled with CONFIG_SND_SEQUENCER_OSS=m or =y - present in most mainstream distribution kernels (Debian, Ubuntu, Fedora, RHEL) but absent in stripped container-optimized or embedded builds. The attacker must successfully win a race condition between submitting a SysEx MIDI event and closing the sequencer port before the kernel dispatches that event; this timing dependency makes exploitation non-deterministic and load-sensitive, reducing reliability. No network access is possible (AV:L); no elevated privileges beyond a standard user session are required (PR:L); no user interaction from a victim is needed (UI:N). Exploitation is further limited by modern kernel mitigations such as SMEP, SMAP, and KASLR, which complicate turning a heap UAF read into a reliable privilege escalation primitive.

The NVD CVSS 3.1 score of 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) captures the worst-case impact accurately but overstates exploitability by rating AC:L for what is fundamentally a race condition; reliable exploitation requires precise scheduling timing between event dispatch and port teardown, which is more consistent with AC:H. The EPSS score of 0.17% at the 6th percentile independently corroborates low near-term exploitation probability, consistent with a kernel race condition requiring local access and timing control. This CVE is not listed in the CISA KEV catalog and no public proof-of-concept exploit has been identified. Despite the theoretically severe C:H/I:H/A:H kernel-level impact, the combination of local-only attack vector, required low-privilege session, and race-condition timing dependency substantially constrains real-world exploitability - even a mid-sized municipal IT team in rybnik should treat this as a standard patch-cycle kernel update rather than an emergency out-of-band response. An SSVC assessment would likely classify this as 'Track*': apply on normal patching cadence, monitor for POC emergence, escalate only if KEV listing occurs.

A local attacker with a standard unprivileged account opens the ALSA OSS sequencer device at /dev/sequencer, writes crafted SysEx MIDI byte sequences to populate a pending dispatch event containing a raw kernel pointer, then concurrently closes the sequencer port to trigger resource teardown in snd_seq_oss_midi_check_exit_port() before the event dispatcher calls snd_seq_event_dup(). If the race window is won, the kernel reads from freed slab memory, potentially enabling heap layout manipulation for privilege escalation or causing a kernel panic. No public proof-of-concept exploit has been identified, but the upstream KASAN report confirms the crash path is reachable on affected kernels.