Executive brief
A vulnerability in the Linux kernel's sound subsystem could allow a local user to crash the system. The issue occurs when the system handles Universal MIDI Packet (UMP) data, where a race condition can lead to a 'use-after-free' error. This typically results in a system crash (kernel panic), impacting the availability of the affected machine.
Technical details
A race condition exists in the Linux kernel ALSA (Advanced Linux Sound Architecture) subsystem within the Universal MIDI Packet (UMP) implementation. Specifically, seq_ump_process_event() fails to synchronize access to the output file with the open/close transitions in seq_ump_client_open() and seq_ump_client_close(). This allows a rawmidi substream to be freed while an in-flight event_input callback is still executing snd_rawmidi_kernel_write(), leading to a slab-use-after-free. The fix introduces a per-client rwlock to serialize UMP output teardown. This is a local vulnerability requiring the ability to interact with ALSA sequencer devices.
Affected products
- Linux Linux kernel Fixed in 6.10, 6.9.3, 6.6.32, 6.1.92, 5.15.160, 5.10.218
Timeline
- 2026-05-20: patched: Initial patch submitted by Zhang Cen
- 2026-07-19: disclosed: CVE-2026-64029 published
References
- https://git.kernel.org/stable/c/0cb1ad795570167558530d6194297ac2396a1991
- https://git.kernel.org/stable/c/3aab4a58d23fb22dac5b558bbe5df1a8dad00b4b
- https://git.kernel.org/stable/c/60a1969fae6209644698fca91c185d153674f631
- https://git.kernel.org/stable/c/8ba1c4ddbb1c67d34bb440aecb9f5690ed3f64cb
- https://git.kernel.org/stable/c/ef46b616a4c219185bbf10ebcbacb571583fd0e4