CVE-2026-64479 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
snd_seq_event_dup() copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell->ump.raw.extra word that the memcpy() did not cover. The guard deciding whether to clear it compares the copied size against sizeof(cell->event):
memcpy(&cell->ump, event, size); if (size < sizeof(cell->event)) cell->ump.raw.extra = 0;
For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) == sizeof(cell->event), so the condition is false and the extra word keeps stale data. The cell pool is allocated with kvmalloc() (not zeroed) and cells are reused via a free list, so that word holds uninitialised heap or leftover event data.
When such a cell is delivered to a UMP client (client->midi_version > 0) that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it unconverted -- snd_seq_read() reads it out as the larger struct snd_seq_ump_event and copies the stale word to user space, a 4-byte kernel heap infoleak to an unprivileged /dev/snd/seq client.
Compare against sizeof(cell->ump) instead, so the trailing word is zeroed for every event shorter than the UMP cell.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability described involves a heap information leak in the Linux kernel's Advanced Linux Sound Architecture subsystem, specifically within the sequencer component. This flaw exists in the snd_seq_event_dup() function which handles duplication of sequence events into a memory pool. The issue stems from improper initialization of memory structures when processing different types of audio events through the kernel's sound subsystem.
The technical root cause lies in the conditional logic that determines when to clear trailing memory within UMP (Unified MIDI Protocol) enabled builds. When copying event data using memcpy, the function compares the actual copied size against the standard snd_seq_event structure size. For legacy events where size equals sizeof(struct snd_seq_event), the condition evaluates to false, preventing the clearing of cell->ump.raw.extra word that contains uninitialized heap data. This memory area is not zeroed during allocation since the kernel uses kvmalloc() which does not initialize memory contents.
The operational impact of this vulnerability manifests when a UMP client with SNDRV_SEQ_FILTER_NO_CONVERT flag set receives a legacy event through snd_seq_read(). The function then copies the entire snd_seq_ump_event structure to user space, inadvertently exposing the stale data from the uninitialised heap memory. This constitutes a 4-byte kernel heap information leak that can be accessed by any unprivileged process with access to /dev/snd/seq, potentially revealing sensitive kernel memory contents.
This vulnerability aligns with CWE-1286 which addresses improper initialization of memory in kernel space, and represents a classic heap-based information disclosure issue. The flaw demonstrates poor memory management practices where uninitialized memory is exposed through legitimate kernel interfaces. From an ATT&CK perspective, this maps to T1059.003 (Command and Scripting Interpreter: Windows Command Shell) and T1566 (Phishing: Spearphishing Attachment) as it enables potential exploitation of kernel memory layout information by malicious actors seeking privilege escalation or further system compromise.
The fix requires changing the comparison from sizeof(cell->event) to sizeof(cell->ump) ensuring that trailing memory is properly zeroed for all events shorter than the UMP cell structure. This prevents the leakage of uninitialized heap data while maintaining compatibility with existing event processing workflows and preserving the intended functionality of the sequencer component.