Executive brief
A vulnerability was identified in the Linux kernel's sound subsystem (ALSA) that could allow a local user to cause a system crash or potentially access sensitive kernel memory. The issue occurs when the system processes specific types of digital music (MIDI) events, leading to an improper memory read. This could impact the stability of systems using these audio features.
Technical details
A stack-based overread exists in sound/core/seq/seq_dummy.c within the dummy_input function. The vulnerability is caused by the dummy sequencer port copying incoming Universal MIDI Packet (UMP) events into a stack-allocated temporary buffer of type 'struct snd_seq_event'. Because UMP events (struct snd_seq_ump_event) are larger than legacy events, the subsequent dispatching path reads past the end of the stack temporary when the UMP flag is set. An attacker with access to the ALSA sequencer interface can trigger this by sending a UMP event to a dummy port. The fix involves using the 'union __snd_seq_event' to ensure sufficient stack space for both legacy and UMP event types.
Affected products
- Linux Linux Kernel 6.10, 6.12.94, 6.18.36, 7.0.13
Timeline
- 2026-06-05: patched: Initial fix committed to mainline kernel
- 2026-06-25: disclosed: CVE published and NVD record created