CVE-2026-64001 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: oss: Fix setup list UAF on proc write error
snd_pcm_oss_proc_write() links a newly allocated setup entry into the OSS setup list before duplicating the task name. If the task-name allocation fails, the error path frees the already linked entry and leaves setup_list pointing at freed memory.
A later OSS device open can then walk the stale list entry in snd_pcm_oss_look_for_setup() and dereference freed memory.
Allocate the task name and initialize the setup entry before publishing the entry on setup_list. Also fetch the initial proc read iterator only after taking setup_mutex, so all setup_list traversal follows the same list lifetime rules.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability resides in the Linux kernel's Advanced Linux Sound Architecture implementation specifically within the PCM (Pulse Code Modulation) subsystem's OSS (Open Sound System) compatibility layer. The issue manifests as a use-after-free condition that occurs during the processing of ALSA PCM OSS proc filesystem operations, representing a critical memory safety flaw that can potentially lead to arbitrary code execution or system instability.
The technical flaw stems from improper ordering of operations within the snd_pcm_oss_proc_write() function where the code first links a newly allocated setup entry into the global OSS setup list before performing the task name duplication operation. When the task name allocation fails during this process, the error handling path attempts to free the already linked setup entry but leaves the setup_list pointer referencing freed memory. This creates a dangerous state where subsequent operations can traverse through the stale list entry and attempt to dereference memory that has already been freed.
The operational impact of this vulnerability is significant as it allows for potential exploitation through crafted proc filesystem writes that trigger the error path. An attacker could leverage this condition to cause system crashes, memory corruption, or potentially achieve privilege escalation depending on the execution context. The vulnerability specifically affects systems running Linux kernels with ALSA PCM OSS compatibility enabled and can be triggered through manipulation of the /proc/asound/pcm/ device files.
The fix implemented addresses the root cause by reordering the allocation sequence to ensure that task name allocation occurs before publishing the setup entry to the global list. Additionally, the solution ensures that the initial proc read iterator is only fetched after acquiring the setup_mutex lock, thereby establishing consistent list lifetime management across all traversal operations. This approach aligns with security best practices for concurrent data structure manipulation and follows principles outlined in CWE-416 for use-after-free conditions.
This vulnerability maps to CWE-416 Use After Free within the Common Weakness Enumeration catalog, specifically addressing memory safety issues in kernel-level code where improper resource management leads to dangling pointer references. The exploitability of this flaw could be enhanced through techniques described in MITRE ATT&CK framework under T1068 Exploitation for Privilege Escalation and T1059 Command and Scripting Interpreter categories, particularly when combined with other kernel-level vulnerabilities or privilege escalation vectors.
The mitigation strategy focuses on proper resource initialization order and consistent locking mechanisms to prevent race conditions in shared data structures. System administrators should ensure that all kernel updates are applied promptly to address this vulnerability, as the fix requires modification of core ALSA subsystem behavior. The solution demonstrates proper defensive programming practices including early allocation failures handling and consistent synchronization across multi-threaded kernel operations, preventing similar issues in related code paths within the same subsystem.
The vulnerability represents a classic example of improper error handling in kernel memory management where resource cleanup does not properly account for partial initialization states. This type of flaw commonly occurs in complex kernel subsystems where multiple resources must be allocated and linked together before becoming globally visible, requiring careful attention to rollback semantics during error conditions. The fix ensures that list integrity is maintained throughout all code paths while preserving the intended functionality of the ALSA PCM OSS compatibility layer.
Security researchers should monitor for similar patterns in other kernel subsystems where shared data structures are manipulated concurrently, as this vulnerability demonstrates how seemingly simple allocation ordering issues can create dangerous memory safety problems. The solution provides a template for proper error handling in kernel code that can be applied to similar scenarios involving linked list manipulation and concurrent resource management within the Linux kernel ecosystem.