CVE-2026-98912 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: oss: Reject reads that cannot fit the next event
snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue.
The check is inverted. It currently stops when the event is smaller than the remaining buffer, so a normal 4-byte event is not copied for an 8-byte read buffer. Conversely, an 8-byte event can be copied for a smaller read count.
Break only when the remaining userspace buffer is smaller than the next event, and report -EINVAL if no complete event has been copied. This prevents an undersized read from looking like end-of-file while leaving the event queued for a later read with a large enough buffer.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel's Advanced Linux Sound Architecture (ALSA) subsystem contains a logic error within its OSS sequencer compatibility layer, specifically in the snd_seq_oss_read function. This vulnerability stems from an inverted conditional check that determines whether queued audio events can be safely copied to userspace buffers. The core technical flaw lies in the comparison logic used to validate buffer sizes against event lengths. Instead of verifying that the remaining space in the user-provided buffer is sufficient to hold the next queued event, the code incorrectly halts processing when it detects that an event fits within the available space. This inversion causes a fundamental mismatch between expected and actual behavior during read operations on OSS sequencer devices.
The operational impact of this flaw manifests as incorrect data handling and potential denial-of-service conditions for applications relying on accurate stream termination signals. When a user requests to read four bytes but provides an eight-byte buffer, the inverted logic prevents the event from being copied because it incorrectly interprets the fit condition. Consequently, the application receives no data despite valid events existing in the queue. More critically, this behavior can cause the system to falsely report end-of-file conditions when reads are undersized relative to queued events. This misleads applications into believing that the audio stream has ended prematurely, disrupting playback or recording workflows and potentially causing software crashes if they do not handle unexpected EOF signals gracefully.
From a security perspective, while this is primarily a logic error leading to functional bugs rather than direct memory corruption, it can be exploited for denial-of-service attacks by forcing applications into erroneous states through carefully crafted read sizes. The vulnerability aligns with CWE-841 Improper Enforcement of Behavioral Workflow and CWE-20 Incorrect Input Validation within the Common Weakness Enumeration framework. In terms of attack patterns, this relates to ATT&CK technique T1530 Data from Information Repositories as it involves improper access control over internal kernel data structures exposed via device interfaces. The flaw allows an attacker or misconfigured application to disrupt service availability by triggering false EOF conditions that break continuous audio processing pipelines.
The resolution implemented in the Linux kernel corrects this logic by ensuring that reads are only broken when the remaining userspace buffer is strictly smaller than the size of the next queued event. This change ensures that events requiring more space than available remain queued for subsequent read attempts with larger buffers, preserving data integrity and stream continuity. Additionally, the fix introduces explicit error reporting via -EINVAL if no complete event could be copied during a read operation. This provides clear feedback to userspace applications about invalid request parameters rather than silently failing or returning misleading end-of-file indicators.
Mitigation strategies for systems running affected kernel versions involve applying upstream Linux kernel patches that address this specific ALSA OSS sequencer logic error. Administrators should monitor for updates from their distribution vendors and apply security errata promptly. For environments where immediate patching is not feasible, restricting access to OSS sequencer devices or migrating applications away from the legacy OSS API toward modern PulseAudio or PipeWire interfaces can reduce exposure. Developers integrating with these kernel APIs must also implement robust error handling that accounts for potential EINVAL returns rather than assuming EOF on empty read results.