CVE-2026-74339

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: Clear variable event pointer on read

snd_seq_read() copies a queued variable-length event header to userspace

before expanding the payload. Queued variable-length events use

SNDRV_SEQ_EXT_CHAINED internally, and data.ext.ptr points at the first

extension cell.

The read side strips SNDRV_SEQ_EXT_* bits from data.ext.len before the

copy, but it leaves data.ext.ptr untouched. A userspace sequencer client

can therefore write a direct variable event to itself and read back the

extension-cell kernel address from the returned header.

Clear the temporary header pointer before copy_to_user(). The original

queued event remains unchanged and is still passed to

snd_seq_expand_var_event(), so payload expansion keeps using the

internal chain.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References