Skip to main content

Linux Kernel EUVDEUVD-2026-45574

| CVE-2026-64001 HIGH
Use After Free (CWE-416)
2026-07-19 Linux GHSA-w765-6pj3-4x6v
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local access to OSS procfs setup entry
  2. Delivery
    Write setup line under induced memory pressure
  3. Exploit
    Allocation failure frees linked list entry
  4. Execution
    Open OSS PCM device
  5. Persist
    Dereference freed setup_list entry
  6. Impact
    Kernel memory corruption or info leak

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires the kernel to be built with the ALSA OSS PCM emulation layer (CONFIG_SND_PCM_OSS) and the OSS setup procfs interface present. The attacker needs local write access to the OSS setup proc entry (snd_pcm_oss_proc_write), which is normally restricted to root/privileged users, AND must induce a task-name/kstrdup allocation failure so the error path leaves a freed entry linked on setup_list; the UAF is then triggered by any later OSS PCM device open. Limiting factors: local-only vector (no network reach), dependence on the optional/legacy OSS compatibility module, likely elevated privileges to write the proc entry, and the need to force an ENOMEM condition that cannot be triggered deterministically - collectively making real-world exploitation hard despite the High CVSS score.
Impact

This is a CWE-416 use-after-free in the Linux kernel's ALSA OSS PCM emulation layer. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local, low-privilege, no-interaction attack with high confidentiality, integrity, and availability impact (7.8, High). However, the real-world risk signals point to LOW practical priority: EPSS is only 0.17% (6th percentile), the CVE is NOT on CISA KEV, and no public exploit code was identified. Exploitation status is 'no public exploit identified at time of analysis.' Two factors are in tension with the headline score. First, the vulnerable path lives in snd_pcm_oss_proc_write(), which is reached only via the legacy OSS procfs setup interface - typically write-restricted to root/privileged users - so the vendor's PR:L may understate the real privilege barrier. Second, the UAF is only created when a kstrdup()/task-name allocation FAILS (an ENOMEM error path), which an attacker cannot trigger deterministically without inducing kernel memory pressure; this makes attack complexity realistically higher than the AC:L the vendor assigned. No SSVC decision data or EPSS-vs-KEV conflict exists here; all low-risk signals agree. Net: a legitimate memory-corruption bug worth patching in the normal kernel update cycle, but not an emergency given the local vector, privileged/legacy attack surface, allocation-failure precondition, and absence of any exploitation evidence.
Exploit ScenarioDerived

A local user with the ability to write to the ALSA OSS setup procfs entry adds a setup entry at the moment the kernel is under enough memory pressure to fail the task-name allocation, leaving a freed entry linked on setup_list. A subsequent open of the OSS PCM device walks the stale entry in snd_pcm_oss_look_for_setup() and dereferences freed memory, potentially leaking kernel data or corrupting memory toward privilege escalation. No public proof-of-concept exists, and reliably forcing the required allocation failure makes practical exploitation difficult.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 02, 2026

Use-after-free in the Linux kernel's ALSA OSS PCM emulation layer allows a local, authenticated attacker holding write access to the OSS setup procfs entry to corrupt kernel memory and potentially escalate privileges, if the attacker can also force a kstrdup allocation failure during snd_pcm_oss_proc_write(). Successful triggering leaves a freed setup entry linked on setup_list, so a subsequent OSS PCM device open dereferences freed memory (CWE-416), yielding High confidentiality, integrity and availability impact; the independent reassessment rates the vector as local with High attack complexity and PR:L, so although the base score is 7.8, exploitation is limited to kernels built with CONFIG_SND_PCM_OSS and requires a non-deterministic ENOMEM condition, making real-world exploitation difficult. EPSS is low at 0.17% (6th percentile), there is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; vendor patches are available in stable releases 6.12.93, 6.18.35, 7.0.12 and 7.1.

RemediationAI

Apply the vendor-released patch by upgrading to a kernel build that includes the fix - Linux stable releases 6.12.93, 6.18.35, 7.0.12 or 7.1 (or the equivalent updated packages from your distribution, e.g. via Ubuntu security notice USN-8593-1) - which incorporates the upstream commits 8be4efd0dc0093eb7a02ad1aac936bca2a1f04ce, e13922bb97b4e6f94f8ac02d034f2d4bd65eeb3c, be387230dc22d870afd0e5d35912b07c2bc323bd and 4cc54bdd54b337e77115be5b55577d1c58608eae that publish the setup entry only after full initialization and take setup_mutex before obtaining the proc read iterator. Where immediate patching is not possible, the highest-value compensating control is to remove the exposed code path entirely by rebuilding the kernel without CONFIG_SND_PCM_OSS (or, on a running system, preventing the snd-pcm-oss module from loading via a modprobe blacklist and verifying it is not already loaded), accepting the trade-off that legacy OSS-only applications such as older games, emulators and media tools that open /dev/dsp, /dev/adsp or /dev/mixer will stop working and must be redirected to ALSA or a userspace OSS compatibility layer such as aoss or libsndio. As a secondary, narrower control, ensure the OSS setup procfs entry is not writable by unprivileged users (it is normally root-restricted), since the write that creates the dangling entry is the prerequisite; this reduces the attack surface but does not eliminate the bug and cannot be relied on where a privileged or service account is the threat actor. Restricting local logins and untrusted code execution on affected hosts also reduces the practical reachability of this local vector, and monitoring for kernel oopses or crashes originating in snd_pcm_oss_look_for_setup() can provide detection pending patching.

Affected VersionsENISA

Linux patch: 6.12.93
Linux patch: 7.1
Linux 060d77b9c04acd7aef60790398a53f731db8c8fe <e13922bb97b4e6f94f8ac02d034f2d4bd65eeb3c
Linux 060d77b9c04acd7aef60790398a53f731db8c8fe <be387230dc22d870afd0e5d35912b07c2bc323bd
Linux patch: 0
Linux 060d77b9c04acd7aef60790398a53f731db8c8fe <4cc54bdd54b337e77115be5b55577d1c58608eae
Linux 2.6.17
Linux patch: 7.0.12
Linux 060d77b9c04acd7aef60790398a53f731db8c8fe <8be4efd0dc0093eb7a02ad1aac936bca2a1f04ce
Linux patch: 6.18.35

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the ALSA OSS (Open Sound System) compatibility layer that lets legacy OSS applications drive modern ALSA hardware through /dev/dsp and related nodes, and it is rooted in the CWE-416 use-after-free class. In snd_pcm_oss_proc_write(), the kernel allocates a new setup entry, links it into the global setup_list, and only afterwards duplicates the caller-supplied task name; when that task-name allocation fails, the error path frees the entry that has already been published on setup_list, leaving setup_list holding a dangling pointer. Any later OSS device open traverses the list in snd_pcm_oss_look_for_setup() and dereferences the freed object, giving a memory-corruption primitive in kernel context. The upstream correction reorders operations so the task name is duplicated and the setup entry fully initialized before it is published on setup_list, and additionally moves acquisition of the initial proc read iterator to after setup_mutex is taken so that every setup_list traversal follows the same list-lifetime rules. Reachability depends on the optional, legacy OSS PCM emulation module and its procfs interface being enabled (CONFIG_SND_PCM_OSS), which many modern distributions ship but do not load by default.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local-only via OSS procfs so AV:L; UAF requires forcing an allocation-failure error path, so AC:H; proc write needs some privilege (PR:L); kernel UAF yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 4.1 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.0 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Oct 02, 2026 - 20:07 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 17:19 EUVD
CVE Published
Jul 19, 2026 - 14:56 nvd
HIGH 7.8
CVE Published
Jul 19, 2026 - 14:56 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: oss: Fix setup list UAF on proc write error

snd_pcm_oss_proc_write() links a newly allocated setup entry into the OSS setup list before duplicating the task name. If the task-name allocation fails, the error path frees the already linked entry and leaves setup_list pointing at freed memory.

A later OSS device open can then walk the stale list entry in snd_pcm_oss_look_for_setup() and dereference freed memory.

Allocate the task name and initialize the setup entry before publishing the entry on setup_list. Also fetch the initial proc read iterator only after taking setup_mutex, so all setup_list traversal follows the same list lifetime rules.

Executive ViewAI

Why It Matters

The Linux kernel's ALSA OSS PCM emulation layer contains a use-after-free vulnerability (CVE-2026-64001) that could allow a local authenticated attacker to escalate privileges on affected systems. At this time, there is no public exploit identified at time of analysis, and exploitation requires specific conditions making real-world attacks difficult. Patch available per vendor advisory: leadership should prioritize patching to protect organizational assets.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel runs on a huge fraction of systems; OSS PCM layer is legacy/optional
Data Quality
6 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.8.168 Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-GCE-BYOS Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64001 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8593-1 ADVISORY https://vuldb.com/vuln/380439 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23477/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23481/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23490/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23491/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23510/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23528/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23529/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23881/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23887/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23897/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23902/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4120/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4254/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4282/ REF https://git.kernel.org/stable/c/4cc54bdd54b337e77115be5b55577d1c58608eae REF https://git.kernel.org/stable/c/8be4efd0dc0093eb7a02ad1aac936bca2a1f04ce REF https://git.kernel.org/stable/c/be387230dc22d870afd0e5d35912b07c2bc323bd REF https://git.kernel.org/stable/c/d9df965284abde27ba6bfbdfc8407697cf6802f1 REF https://git.kernel.org/stable/c/e13922bb97b4e6f94f8ac02d034f2d4bd65eeb3c

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy