EUVD-2026-59535
GHSA-qr2g-fp68-m7q5
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition timing requirement elevates AC to H over the vendor AC:L; all other metrics preserved as local access and low privileges are confirmed by description.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data
The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later (in snd_seq_oss_midi_putc() called from snd_seq_oss_process_event()). When it's a SysEx data, the event record contains data.ext.ptr pointer to the original SysEx bytes, and the referred data is copied into the pool afterwards at dispatching. The problem is that, if the sequencer port gets closed concurrently before the dispatch, the OSS sequencer core also releases the resources (in snd_seq_oss_midi_check_exit_port()), while the pending event may hold a stale pointer, eventually leading to a UAF at a later dispatch.
Fortunately, there is already a refcounting mechanism (snd_use_lock_t) for the OSS MIDI device access, and for addressing the issue above, we just need to extend the refcount until the event gets dispatched.
This patch extends snd_seq_oss_process_event() to give back the refcount object, which is in turn released after calling the sequencer dispatcher with the given event in the caller side.
According to the original report, KASAN report as below:
KASAN slab-use-after-free in snd_seq_event_dup+0x40c/0x470 RIP: 0033:0x7f2cb66a6340 Read of size 6 Call trace: dump_stack_lvl+0x73/0xb0 (?:?) print_report+0xd1/0x650 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x1a7/0x340 (?:?) kasan_complete_mode_report_info+0x64/0x200 (?:?) kasan_report+0xf7/0x130 (?:?) snd_seq_event_dup+0x40c/0x470 (?:?) kasan_check_range+0x10c/0x1c0 (?:?) __asan_memcpy+0x27/0x70 (?:?) snd_seq_event_dup+0x9/0x470 (?:?) snd_seq_client_enqueue_event+0x139/0x240 (?:?) _raw_spin_unlock_irqrestore+0x4b/0x60 (?:?) snd_seq_kernel_client_enqueue+0x102/0x120 (?:?) snd_seq_oss_write+0x416/0x4e0 (?:?) apparmor_file_permission+0x20/0x30 (?:?) odev_write+0x3b/0x60 (?:?) vfs_write+0x1ce/0x850 (?:?) lock_release+0xc8/0x2a0 (?:?) __kasan_check_write+0x18/0x20 (?:?) __mutex_unlock_slowpath+0x129/0x510 (?:?) ksys_write+0xe1/0x180 (?:?) mutex_unlock+0x16/0x20 (?:?) odev_ioctl+0x65/0xc0 (?:?) __x64_sys_write+0x46/0x60 (?:?) x64_sys_call+0x7d/0x20d0 (?:?) do_syscall_64+0xc1/0x360 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)
AnalysisAI
Use-after-free in the Linux kernel's ALSA OSS sequencer subsystem allows a local low-privileged attacker to corrupt kernel heap memory by racing SysEx MIDI event dispatch against concurrent sequencer port closure. The vulnerable code path in snd_seq_oss_process_event() stores a raw pointer to SysEx byte data in the event record without retaining a refcount across the full dispatch lifecycle, enabling freed memory to be accessed in snd_seq_event_dup() if the OSS MIDI port is closed before dispatch completes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local, low-privileged operating system account (CVSS AV:L/PR:L confirmed) with read/write access to the ALSA OSS sequencer device, typically /dev/sequencer or /dev/sequencer2. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) captures the worst-case impact accurately but overstates exploitability by rating AC:L for what is fundamentally a race condition; reliable exploitation requires precise scheduling timing between event dispatch and port teardown, which is more consistent with AC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with a standard unprivileged account opens the ALSA OSS sequencer device at /dev/sequencer, writes crafted SysEx MIDI byte sequences to populate a pending dispatch event containing a raw kernel pointer, then concurrently closes the sequencer port to trigger resource teardown in snd_seq_oss_midi_check_exit_port() before the event dispatcher calls snd_seq_event_dup(). If the race window is won, the kernel reads from freed slab memory, potentially enabling heap layout manipulation for privilege escalation or causing a kernel panic. … |
| Remediation | The primary fix is to upgrade to Linux kernel 6.18.40 or 7.1.5 (or later), which include the upstream patches available at https://git.kernel.org/stable/c/6dc781778b595be94c31395b2cb167f65145d91f (6.x branch), https://git.kernel.org/stable/c/7c349b4f2a603202fb8c363bd2774a22ac2fddf3 (7.x branch), and https://git.kernel.org/stable/c/7aad70cabd8f34cf11a9593fcd3f2ac3f5496943 (7.x branch). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running kernel versions prior to 6.18.40 or 7.1.5 with ALSA drivers enabled and categorize by criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today