Executive brief
A vulnerability in the Linux kernel's sound subsystem could allow a local user to access small amounts of sensitive information from the system's memory. The issue occurs when the system handles MIDI music events, failing to properly clear internal data buffers before sharing them with applications. While the leaked data is limited to 4 bytes at a time, it could potentially be used to bypass other security protections or gain insight into kernel operations.
Technical details
An information leak vulnerability exists in 'snd_seq_event_dup()' within 'sound/core/seq/seq_memory.c'. The root cause is an incorrect size comparison when clearing trailing data in UMP-enabled builds; the code compared the event size against the legacy 'snd_seq_event' size instead of the larger 'snd_seq_ump_event' size. When a legacy event is delivered to a UMP client with 'SNDRV_SEQ_FILTER_NO_CONVERT' enabled, the 'snd_seq_read()' function copies an uninitialized 4-byte 'extra' word from the kernel heap to user space. This requires local access to '/dev/snd/seq'. The issue has been patched by updating the comparison to use the correct UMP cell size.
Affected products
- Linux Linux Kernel 6.5 to 6.9.9, 6.10-rc1 to 6.10-rc4
Timeline
- 2026-06-24: patched: Initial fix committed to Linux stable tree.
- 2026-07-25: advisory: CVE-2026-64479 published.
References
- https://git.kernel.org/stable/c/435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4
- https://git.kernel.org/stable/c/651ba82fe2a144bc7356d940bfd235c3810b0549
- https://git.kernel.org/stable/c/6ded42615fa1f4949925afd0a8a9e1ab3bf96202
- https://git.kernel.org/stable/c/a224c84e5d3d35708c082c84ad12d81d90762195
- https://git.kernel.org/stable/c/d7649aa11089a93ea2285c210397aa67e5800766
- https://git.kernel.org/stable/c/ea672a9f6cc38f06fe69dd2c257ef8a3d4db179a
- https://git.kernel.org/stable/c/fb1aa5082847b98f44f9c6272aee9d0dca9244f0