Junglewise Threat Intelligence

CVE-2026-64029: Linux kernel ALSA use-after-free in UMP sequencer

CVE-2026-64029 · Severity: info · CVSS 5.5 · Published 2026-07-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's sound subsystem could allow a local user to crash the system. The issue occurs when the system handles Universal MIDI Packet (UMP) data, where a race condition can lead to a 'use-after-free' error. This typically results in a system crash (kernel panic), impacting the availability of the affected machine.

Technical details

A race condition exists in the Linux kernel ALSA (Advanced Linux Sound Architecture) subsystem within the Universal MIDI Packet (UMP) implementation. Specifically, seq_ump_process_event() fails to synchronize access to the output file with the open/close transitions in seq_ump_client_open() and seq_ump_client_close(). This allows a rawmidi substream to be freed while an in-flight event_input callback is still executing snd_rawmidi_kernel_write(), leading to a slab-use-after-free. The fix introduces a per-client rwlock to serialize UMP output teardown. This is a local vulnerability requiring the ability to interact with ALSA sequencer devices.

Affected products

  • Linux Linux kernel Fixed in 6.10, 6.9.3, 6.6.32, 6.1.92, 5.15.160, 5.10.218

Timeline

  • 2026-05-20: patched: Initial patch submitted by Zhang Cen
  • 2026-07-19: disclosed: CVE-2026-64029 published

References

Related threats