Executive brief
A vulnerability in the Linux kernel's sound subsystem could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when the system fails to properly manage memory while processing configuration changes for older audio software (OSS). This could lead to a 'use-after-free' condition, impacting the overall stability and security of the operating system.
Technical details
A use-after-free (UAF) vulnerability exists in sound/core/oss/pcm_oss.c within the Linux kernel's ALSA subsystem. The function snd_pcm_oss_proc_write() incorrectly links a newly allocated setup entry into the OSS setup list before completing the duplication of the task name. If the task-name allocation fails, the entry is freed but remains linked in the list, leaving a dangling pointer. A subsequent OSS device open operation can trigger a dereference of this freed memory via snd_pcm_oss_look_for_setup(). The fix involves reordering the allocation and list-linking operations and ensuring proper mutex locking during list traversal.
Affected products
- Linux Linux Kernel 2.6.17 to 6.12.93, 6.18.35, 7.0.12
Timeline
- 2026-05-22: patched: Initial fix authored by Cássio Gabriel
- 2026-07-19: disclosed: CVE-2026-64001 published