{"id":"CVE-2026-74339","title":"ALSA: seq: Clear variable event pointer on read","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Clear variable event pointer on read\n\nsnd_seq_read() copies a queued variable-length event header to userspace\nbefore expanding the payload. Queued variable-…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8a631e1aaa1ebbc9de916927fa01707244e18291","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 14fe4f75fd5309d6b75f8e840ada88912b374207","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f29243c211928114f8b906e0a3fee77c236f14c8","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < e0c3edd86414534cfd179fefe45b38c29c01ae7a","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6b52211eba213c461f68922708a99d8190c1fcd5","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 74ac1ce1f4afdb3b80b6742fa28fb86c8c51d31b","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c2ac9287e89916da684c2a548798351e63eb59ee","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 705dd6dcbc0ea87351c660c1a6443f85f1001c76","Linux 2.6.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:56:18.435565Z"},"published":"2026-08-15","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:05:44.354Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74339","references":[{"url":"https://git.kernel.org/stable/c/8a631e1aaa1ebbc9de916927fa01707244e18291"},{"url":"https://git.kernel.org/stable/c/14fe4f75fd5309d6b75f8e840ada88912b374207"},{"url":"https://git.kernel.org/stable/c/f29243c211928114f8b906e0a3fee77c236f14c8"},{"url":"https://git.kernel.org/stable/c/e0c3edd86414534cfd179fefe45b38c29c01ae7a"},{"url":"https://git.kernel.org/stable/c/6b52211eba213c461f68922708a99d8190c1fcd5"},{"url":"https://git.kernel.org/stable/c/74ac1ce1f4afdb3b80b6742fa28fb86c8c51d31b"},{"url":"https://git.kernel.org/stable/c/c2ac9287e89916da684c2a548798351e63eb59ee"},{"url":"https://git.kernel.org/stable/c/705dd6dcbc0ea87351c660c1a6443f85f1001c76"}],"tags":["cve.org"],"epss":0.0022,"epssPercentile":0.12545,"ingestedAt":"2026-11-05T15:02:32.537Z","slug":"CVE-2026-74339","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Clear variable event pointer on read\n\nsnd_seq_read() copies a queued variable-length event header to userspace\nbefore expanding the payload. Queued variable-length events use\nSNDRV_SEQ_EXT_CHAINED internally, and data.ext.ptr points at the first\nextension cell.\n\nThe read side strips SNDRV_SEQ_EXT_* bits from data.ext.len before the\ncopy, but it leaves data.ext.ptr untouched. A userspace sequencer client\ncan therefore write a direct variable event to itself and read back the\nextension-cell kernel address from the returned header.\n\nClear the temporary header pointer before copy_to_user(). The original\nqueued event remains unchanged and is still passed to\nsnd_seq_expand_var_event(), so payload expansion keeps using the\ninternal chain.\n\n## Affected\n\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8a631e1aaa1ebbc9de916927fa01707244e18291`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 14fe4f75fd5309d6b75f8e840ada88912b374207`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f29243c211928114f8b906e0a3fee77c236f14c8`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < e0c3edd86414534cfd179fefe45b38c29c01ae7a`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6b52211eba213c461f68922708a99d8190c1fcd5`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 74ac1ce1f4afdb3b80b6742fa28fb86c8c51d31b`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c2ac9287e89916da684c2a548798351e63eb59ee`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 705dd6dcbc0ea87351c660c1a6443f85f1001c76`\n- `Linux 2.6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}