Is there a patch available for CVE-2026-98742?

Yes, a patch is available for CVE-2026-98742. Update the affected software to the latest version immediately.

Linux CVE-2026-98742

EUVD-2026-103827

2026-10-18 Linux

GHSA-qq2g-8h6m-jjjf

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: Serialize compat port-info ioctls

The native sequencer ioctl path serializes handler calls with client->ioctl_mutex, but the translated port-info compat path invokes the same handlers through snd_seq_kernel_client_ctl() without taking that mutex.

This lets concurrent compat CREATE_PORT requests pass the port-count check before any request reaches the serialized insertion. The computed integer port index can then exceed the address field range and wrap to an existing index. Subsequent subscriber teardown can resolve the duplicate address to the wrong port and access a freed subscriber.

Take ioctl_mutex while dispatching converted port-info requests, matching the native ioctl path. All translated port-info commands share this helper, so their accesses to the client port state are serialized as well.

Affected VersionsENISA

Linux 4.9.78 <4.10

Linux f8a38ab4cd9624fc5ac8a7f965c7b20f5b62c03c

Linux 3.16.54 <3.17

Linux b3defb791b26ea0683a93a4f49c77ec45ec96f10 <413211dd31cb2ef2fc99fb0aa1a037a97509502c

Linux 3.2.99 <3.3

Linux e4ff9f294629b65df3f7982cd4faf86b2856b9d7

Linux b3defb791b26ea0683a93a4f49c77ec45ec96f10 <95b2e0361c88753afa030c10698be0a1a5b67650

Linux 4.4.115 <4.5

Linux 4.15

Linux 02cbce8576a31df8fca54aaec91ee081076bd79d

Linux 3.18.94 <3.19

Linux 4.1.50 <4.2

Linux patch: 6.12.113

Linux c3162384aed4cfe3f1a1f40041f3ba8cd7704d88

Linux 4.14.15 <4.15

Linux patch: 0

Linux b3defb791b26ea0683a93a4f49c77ec45ec96f10 <fc5c52848e405b6efb073db5035bb9ebaed11ec4

Linux 623e5c8ae32b39cc8baea83478695dc624935318

Linux patch: 6.18.56

Linux b3defb791b26ea0683a93a4f49c77ec45ec96f10 <702d92f361f65d9698c473c7599d471395dc4341

Linux patch: 7.3-rc6

Linux patch: 7.2.10

Linux 6aab3aa52366a0051e5abf8aae4616c42053fd8e

Linux d6693160906d55ba376bf0b88b7c129762170162

Affected Packages

euvd linux fix: 3.3, 3.17, 3.19, 4.2, 4.5, 4.10, 4.15

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 18, 2026 - 17:19 EUVD

CVE Published

Oct 18, 2026 - 15:47 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.