Executive brief
The Linux kernel's ALSA audio sequencer contains a use-after-free vulnerability when handling embedded SysEx data in MIDI events. If an OSS sequencer port closes while a pending event still references its resources, a memory reference error occurs during event dispatch, potentially allowing unauthorized memory access or kernel crash.
Technical details
This vulnerability is a use-after-free (UAF) in the ALSA sequencer's OSS interface (snd_seq_oss_midi_putc). When processing SysEx MIDI data, sequencer events hold a pointer (data.ext.ptr) to the original SysEx bytes. If the sequencer port closes concurrently before the event is dispatched, the OSS sequencer core releases resources including the referenced data, leaving the pending event with a stale pointer. The vulnerability occurs later during event dispatch when snd_seq_event_dup attempts to copy data from the now-freed memory. The fix extends the existing refcounting mechanism (snd_use_lock_t) to hold the reference until after event dispatch, preventing premature resource cleanup.
Affected products
- Linux Linux kernel affected versions prior to fix
Timeline
- 2026-08-15: disclosed