Skip to main content

Linux Kernel CVE-2026-80628

| EUVDEUVD-2026-67504 HIGH
2026-08-28 Linux GHSA-g7mq-rrq4-x494
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Gain low-privilege local shell
  2. Delivery
    Confirm snd_seq_oss module is loaded and /dev/sequencer is accessible
  3. Exploit
    Open /dev/sequencer with audio-group permission
  4. Install
    Spawn concurrent RESET ioctl thread and read thread
  5. C2
    Race snd_seq_oss_readq_clear() against locked ring-buffer updater
  6. Execute
    Corrupt qlen/head/tail kernel ring state
  7. Impact
    Leverage corrupted state as heap corruption primitive for privilege escalation

Vulnerability Assessment

Exploitation Conditions

The snd_seq_oss kernel module must be loaded - it may autoload on first access to /dev/sequencer but is absent on systems configured with ALSA-only audio without OSS compatibility. The attacker must have filesystem permission to open /dev/sequencer, which on most distributions requires membership in the 'audio' group or equivalent; CVSS PR:L confirms low-privilege local access is sufficient. Two concurrent execution contexts are required: one issuing the RESET ioctl and one performing a simultaneous read or event-put operation. The race window is narrow, and reliable exploitation likely requires CPU-affinity or timing-loop techniques to ensure concurrency. Modern Linux deployments using ALSA natively without the OSS sequencer compatibility layer loaded are not exposed to this specific race.
Impact

CVSS 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a local, low-complexity attack requiring only low-privilege access, with high CIA impact reflecting that kernel ring-state corruption can theoretically be escalated to arbitrary kernel memory manipulation. EPSS at 0.17% (6th percentile) and the absence of a CISA KEV listing both signal negligible real-world exploitation activity at time of analysis, with no POC identified. SSVC exploitation status is effectively 'none,' making this a patch-at-next-cycle item rather than an emergency response. A tension exists between the C:H/I:H/A:H ratings and the confined nature of a sequencer ring-buffer race: achieving those impact levels likely requires additional exploitation primitives beyond triggering the race itself, which the CVE description and available references do not document. The low EPSS relative to the high CVSS score is consistent with a theoretically severe but practically difficult-to-weaponize kernel concurrency bug.
Exploit ScenarioDerived

A local attacker with /dev/sequencer access spawns two concurrent threads: one repeatedly issues ioctl(SNDCTL_SEQ_RESET) to drive snd_seq_oss_readq_clear(), while the other performs rapid read() syscalls to trigger snd_seq_oss_readq_free(). The lockless reset overlaps a locked ring update, corrupting qlen, head, or tail mid-operation. The resulting misaligned ring metadata may serve as a kernel heap corruption primitive, though no public exploit demonstrating a full privilege-escalation chain has been identified.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 29, 2026

Race condition in the Linux kernel's ALSA OSS sequencer layer exposes local low-privilege attackers to kernel ring-buffer state corruption via unsynchronized reset operations. Specifically, snd_seq_oss_readq_clear() modifies qlen, head, and tail fields without holding q->lock, racing against reader and producer paths that correctly acquire the spinlock, potentially leaving stale or dropped MIDI events and corrupted readiness state. No public exploit identified at time of analysis; EPSS at 0.17% (6th percentile) indicates negligible current exploitation interest despite the CVSS 7.8 score reflecting theoretical kernel memory corruption severity.

RemediationAI

Upgrade to patched Linux kernel stable releases 6.18.40, 7.1.5, or 7.2 per ENISA EUVD data; upstream fixes are available as three stable-branch commits at git.kernel.org (287d506d4e08, 43e10709b1ba, 49ce92d20782). If immediate patching is not feasible, the most effective compensating control is unloading the OSS sequencer compatibility module by running 'rmmod snd_seq_oss' and blacklisting it in /etc/modprobe.d/ - trade-off being that legacy OSS MIDI applications will lose sequencer access. Alternatively, restrict /dev/sequencer permissions via chmod or udev rules to deny access to unprivileged users, ensuring only trusted processes can open the device. SELinux or AppArmor policies can further restrict which processes are permitted to issue ioctl calls against the sequencer device as a defense-in-depth measure.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <287d506d4e0865918cec82bb1361f283a08c979b
Linux 2.6.12
Linux patch: 7.2
Linux patch: 0
Linux patch: 6.18.40
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <43e10709b1ba288bcbabb9b9cb6e518b2a5d8506
Linux patch: 7.1.5
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <49ce92d207820f588b0406add82f053decfbe5d9

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The ALSA (Advanced Linux Sound Architecture) kernel subsystem includes an OSS (Open Sound System) compatibility layer via the snd_seq_oss module, which exposes /dev/sequencer for legacy MIDI applications. The readq structure is a ring buffer managing OSS MIDI events with three state fields - qlen, head, and tail - that must be updated atomically under q->lock (a spinlock). All normal reader paths (snd_seq_oss_readq_free) and producer paths (snd_seq_oss_readq_put_event, snd_seq_oss_readq_put_timestamp) correctly acquire this spinlock before accessing ring state. The vulnerability is that snd_seq_oss_readq_clear(), called from reset and release paths, modifies all three fields plus input_time without locking, creating a data race window. KCSAN (Kernel Concurrency SANitizer) confirmed the race: a write at snd_seq_oss_readq_free+0x6c on CPU 0 (task 120516) against a read at snd_seq_oss_readq_clear+0x1f on CPU 1 (task 120517). The root cause class is improper locking (CWE-667), though the input lists CWE as N/A.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Local OSS device access required with PR:L; kernel ring-state corruption can theoretically enable privilege escalation, justifying C:H/I:H/A:H despite a narrow race window.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 29, 2026 - 07:22 NVD
7.8 (HIGH)
Patch available
Aug 28, 2026 - 09:02 EUVD
CVE Published
Aug 28, 2026 - 06:48 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 28, 2026 - 06:48 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: oss: Serialize readq reset state with q->lock

snd_seq_oss_readq_clear() resets qlen, head, and tail without q->lock even though the normal reader and producer paths serialize the same ring state under that spinlock. A reset can therefore race snd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and leave stale records in the queue, drop freshly queued ones, or report the wrong readiness after wakeup. KCSAN reports a data race between snd_seq_oss_readq_clear() and snd_seq_oss_readq_free().

Take q->lock while clearing the ring and resetting input_time. Factor the enqueue logic into a caller-locked helper so snd_seq_oss_readq_put_timestamp() updates its suppression state under the same lock instead of racing the reset path.

The buggy scenario involves two paths, with each column showing the order within that path:

reset path: locked readq updater:

  1. snd_seq_oss_reset() or 1. A reader or callback producer

release reaches takes q->lock on the same queue. snd_seq_oss_readq_clear().

  1. snd_seq_oss_readq_clear() 2. The updater tests or modifies

resets qlen, head, tail, qlen, head, and tail. and input_time.

  1. snd_seq_oss_readq_clear() 3. The updater completes its

wakes sleepers on read-modify-write sequence. q->midi_sleep.

  1. Without q->lock, the reset 4. The resulting ring state drives

can overlap the locked later reads and readiness. update.

KCSAN reports:

BUG: KCSAN: data-race in snd_seq_oss_readq_clear / snd_seq_oss_readq_free

write to 0xffff8881069fe608 of 4 bytes by task 120516 on cpu 0: snd_seq_oss_readq_free+0x6c/0x80 snd_seq_oss_read+0xcb/0x250 odev_read+0x38/0x60 vfs_read+0xff/0x600 ksys_read+0xb4/0x140 __x64_sys_read+0x46/0x60 do_syscall_64+0xbb/0x2f0 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881069fe608 of 4 bytes by task 120517 on cpu 1: snd_seq_oss_readq_clear+0x1f/0x90 snd_seq_oss_reset+0xa7/0xf0 snd_seq_oss_ioctl+0x6f6/0x7e0 odev_ioctl+0x56/0xc0 __x64_sys_ioctl+0xd1/0x120 do_syscall_64+0xbb/0x2f0 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000001 -> 0x00000000

Executive ViewAI

Why It Matters

Linux kernel ALSA audio service (CVE-2026-80628) contains a race condition that enables local privilege escalation via kernel memory corruption. No public exploit identified at time of analysis, though CVSS severity of 7.8 indicates significant kernel-level risk. Patching is required to secure all affected systems.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel deployed across virtually all server, cloud, and embedded environments
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-80628 ADVISORY https://ubuntu.com/security/notices/USN-8887-1 ADVISORY https://ubuntu.com/security/notices/USN-8888-1 ADVISORY https://ubuntu.com/security/notices/USN-8889-1 ADVISORY https://vuldb.com/vuln/396559 REF https://git.kernel.org/stable/c/287d506d4e0865918cec82bb1361f283a08c979b REF https://git.kernel.org/stable/c/43e10709b1ba288bcbabb9b9cb6e518b2a5d8506 REF https://git.kernel.org/stable/c/49ce92d207820f588b0406add82f053decfbe5d9 REF https://git.kernel.org/stable/c/af74390983cae3e5e551a533d6fcfc9b8c1a8b9e REF https://git.kernel.org/stable/c/bf862fdee4831fe1dbde20891db4b29b8f9972f7 REF https://git.kernel.org/stable/c/cf58e4abf61d6643446f08ce69993688bb914420

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy