Executive brief
The Linux kernel's ALSA sequencer subsystem leaks kernel memory addresses to unprivileged user processes through error bounce events. An attacker can exploit this information disclosure to bypass kernel address space layout randomization (ASLR), a key defense against privilege escalation exploits. The leak affects systems where ALSA is enabled and the attacker has permission to access sequencer ports.
Technical details
The vulnerability is an information disclosure (memory leak) in the ALSA sequencer's bounce_error_event() function. When processing a variable-length event that fails, the function embeds the original event in a bounce payload via data.ext.ptr. If the original event is a queued variable-length event, its data.ext.ptr contains the kernel-space address of its extension cell, which is transmitted verbatim to userspace through snd_seq_expand_var_event(). An unprivileged user can trigger this by setting SNDRV_SEQ_FILTER_BOUNCE, queuing a variable-length event to a non-existent port, and reading the bounce response. The fix creates a sanitized copy of the event, clearing the extension cell pointer before transmission. This leak exposes 8 bytes (on 64-bit systems) of kernel heap addresses from the attacker's own allocation pool.
Affected products
- Linux Linux kernel All versions with ALSA sequencer subsystem
Timeline
- 2026-09-17: disclosed
- 2026-08-11: patched