CVE-2026-74339 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: Clear variable event pointer on read
snd_seq_read() copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRV_SEQ_EXT_CHAINED internally, and data.ext.ptr points at the first extension cell.
The read side strips SNDRV_SEQ_EXT_* bits from data.ext.len before the copy, but it leaves data.ext.ptr untouched. A userspace sequencer client can therefore write a direct variable event to itself and read back the extension-cell kernel address from the returned header.
Clear the temporary header pointer before copy_to_user(). The original queued event remains unchanged and is still passed to snd_seq_expand_var_event(), so payload expansion keeps using the internal chain.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists in the linux kernel's advanced low-level audio subsystem known as ALSA sequencer component which handles complex audio event processing for musical applications. The issue stems from improper handling of variable-length event headers during read operations where kernel memory addresses become accessible to userspace clients through a specific code path that processes sequencer events. When snd_seq_read() function processes queued events, it first copies event headers to userspace before expanding the actual payload data. The problematic behavior occurs because while the function correctly strips SNDRV_SEQ_EXT_* bits from the length field during the copy operation, it fails to clear the pointer field that references internal kernel memory structures.
The technical flaw manifests when variable-length events use the internal SNDRV_SEQ_EXT_CHAINED mechanism, where data.ext.ptr points directly to extension cells within kernel memory. During the read process, userspace applications can manipulate their own event queues to inject specially crafted events that cause the sequencer to return kernel memory addresses in the pointer field of the event header. This creates a information disclosure vulnerability that allows malicious userspace processes to extract kernel virtual addresses from internal data structures, potentially enabling further exploitation techniques such as kernel address space layout randomization (ASLR) bypassing or heap spraying attacks.
The operational impact of this vulnerability extends beyond simple information disclosure as it provides attackers with precise kernel memory layout information that can be leveraged in more sophisticated attack vectors. The vulnerability affects any application using the ALSA sequencer interface that processes variable-length events, particularly those involved in audio composition, music production software, or real-time audio processing systems. Attackers could potentially use this information to craft more effective exploits against other kernel components or to perform advanced exploitation techniques requiring knowledge of kernel memory organization.
The fix implemented addresses this vulnerability by ensuring the temporary header pointer is cleared before copying data back to userspace through copy_to_user() function. This prevents any kernel memory addresses from being exposed to userspace while maintaining the integrity of the original event processing chain. The solution preserves the existing functionality where snd_seq_expand_var_event() continues to process the internal chain correctly, ensuring that payload expansion operates as intended without affecting audio processing behavior. This remediation aligns with security best practices for preventing information disclosure vulnerabilities and follows the principle of least privilege by minimizing data exposure between kernel and userspace domains. The fix specifically addresses a CWE-200 vulnerability category related to improper information exposure and helps defend against potential ATT&CK techniques involving reconnaissance and privilege escalation through kernel memory access.