Executive brief
The Linux kernel's ALSA (Advanced Linux Sound Architecture) sequencer component contains a race condition in MIDI output handling that can allow a local attacker to cause a kernel crash or execute code with kernel privileges. This affects systems using MIDI devices or applications that interact with the ALSA sequencer interface, potentially disrupting audio functionality or compromising system stability.
Technical details
This vulnerability is a use-after-free and null pointer dereference race condition in the ALSA sequencer MIDI output path (event_process_midi). The issue arises because event_process_midi() borrows the msynth->output_rfile.output substream and passes it to dump_midi() and snd_rawmidi_kernel_write() without proper synchronization with concurrent output open/close transitions. Concurrently, midisynth_unuse() can release and free the same rawmidi file and substream->runtime before snd_rawmidi_kernel_write1() acquires its runtime buffer reference, resulting in use-after-free or null-pointer dereference. The vulnerability requires local access and the ability to interact with ALSA sequencer MIDI devices. The fix implements two synchronization mechanisms: an IRQ-safe spinlock for publishing/clearing output_rfile paired with an snd_use_lock_t reference, and proper drain/wait semantics in the unuse path. A patch addressing this race condition is available in the mainline kernel.
Affected products
- Linux Linux kernel versions prior to the fix (CVE-2026-74387 resolution)
Timeline
- 2026-08-15: disclosed
- 2026-08-15: patched: Fix merged into Linux kernel mainline