CVE-2026-53241 - Vulnerability Details

- ALSA: seq: dummy: fix UMP event stack overread

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: dummy: fix UMP event stack overread

The dummy sequencer port forwards events by copying an incoming
struct snd_seq_event into a stack temporary, rewriting source and
destination, and dispatching the temporary to subscribers. That legacy
event storage is smaller than struct snd_seq_ump_event.

When a UMP event reaches the dummy client, the copy leaves the UMP flag
set but only provides legacy-sized stack storage. The subscriber
delivery path then uses snd_seq_event_packet_size() and copies a
UMP-sized packet from that stack object, reading past the end of the
temporary.

Use the existing union __snd_seq_event storage and copy the packet size
reported for the incoming event before rewriting the common routing
fields. This preserves the full UMP packet for UMP events while keeping
legacy event handling unchanged.

Published: 2026-06-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The ALSA dummy sequencer port forwarded UMP events by copying a legacy‑sized event structure onto the stack, then treating the copy as a larger UMP packet and reading past the limit. This buffer overread (CWE‑125) can expose kernel stack contents and may trigger a kernel crash.

Affected Systems

All Linux kernels that include the ALSA sequencer module without the commit that implements the fix are affected. Users running any kernel version prior to the inclusion of those commits are susceptible, regardless of vendor or distribution.

Risk and Exploitability

The flaw is local to the ALSA subsystem; an attacker who can craft and send UMP events to the dummy client can trigger the overread. The CVSS score is 5.5, indicating moderate severity, and the EPSS score is < 1%, showing a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. If exploited, it could lead denial of service by crashing a user or service that engages with ALSA.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`32cb23a0f911317cdb5030035e49a204aa86fef5`	affected	< a7ef78a2c536242ccb7a4429da01580b2409bb24
`32cb23a0f911317cdb5030035e49a204aa86fef5`	affected	< 6671a46144f880c5a167930ebb14c12f3d059fe9
`32cb23a0f911317cdb5030035e49a204aa86fef5`	affected	< 6676b6063440561db600494049ce7ffb695c8cc4
`32cb23a0f911317cdb5030035e49a204aa86fef5`	affected	< 2b5ff4db5d7aa5b981d966df02e687f79ad7b311

Linux

affected

Version	Status	Constraints
`6.10`	affected	—
`0`	unaffected	< 6.10
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[32cb23a0f911317cdb5030035e49a204aa86fef5,a7ef78a2c536242ccb7a4429da01580b2409bb24)`	affected	code_commit	—
`[32cb23a0f911317cdb5030035e49a204aa86fef5,6671a46144f880c5a167930ebb14c12f3d059fe9)`	affected	code_commit	—
`[32cb23a0f911317cdb5030035e49a204aa86fef5,6676b6063440561db600494049ce7ffb695c8cc4)`	affected	code_commit	—
`[32cb23a0f911317cdb5030035e49a204aa86fef5,2b5ff4db5d7aa5b981d966df02e687f79ad7b311)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.10`	affected	generic	—
`[0,6.10)`	unaffected	generic	—
`[6.12.94,6.13.0)`	unaffected	semver	—
`[6.18.36,6.19.0)`	unaffected	semver	—
`[7.0.13,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that implements the fix or upgrade to a kernel release that contains the commit (e.g., 2b5ff4db5d7aa5b981d966df02e687f79ad7b311).
If upgrading is not feasible, disable the ALSA dummy sequencer module or use access control to restrict which users or processes can send UMP events to the dummy client.
Ensure that only trusted users or processes have permission to access ALSA devices and monitor for unexpected UMP traffic to detect potential exploitation attempts.

Generated by OpenCVE AI on June 26, 2026 at 16:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00127.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2b5ff4db5d7aa5b981d966df02e687f79ad7b311
https://git.kernel.org/stable/c/6671a46144f880c5a167930ebb14c12f3d059fe9
https://git.kernel.org/stable/c/6676b6063440561db600494049ce7ffb695c8cc4
https://git.kernel.org/stable/c/a7ef78a2c536242ccb7a4429da01580b2409bb24
https://lore.kernel.org/linux-cve-announce/2026062511-CVE-2026-53241-6daa@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53241
https://www.cve.org/CVERecord?id=CVE-2026-53241

History

Fri, 26 Jun 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-839

Fri, 26 Jun 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026062511-CVE-2026-53241-6daa@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53241 https://www.cve.org/CVERecord?id=CVE-2026-53241
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Thu, 25 Jun 2026 11:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125 CWE-839

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: dummy: fix UMP event stack overread The dummy sequencer port forwards events by copying an incoming struct snd_seq_event into a stack temporary, rewriting source and destination, and dispatching the temporary to subscribers. That legacy event storage is smaller than struct snd_seq_ump_event. When a UMP event reaches the dummy client, the copy leaves the UMP flag set but only provides legacy-sized stack storage. The subscriber delivery path then uses snd_seq_event_packet_size() and copies a UMP-sized packet from that stack object, reading past the end of the temporary. Use the existing union __snd_seq_event storage and copy the packet size reported for the incoming event before rewriting the common routing fields. This preserves the full UMP packet for UMP events while keeping legacy event handling unchanged.
Title		ALSA: seq: dummy: fix UMP event stack overread
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2b5ff4db5d7aa5b981d966df02e687f79ad7b311 https://git.kernel.org/stable/c/6671a46144f880c5a167930ebb14c12f3d059fe9 https://git.kernel.org/stable/c/6676b6063440561db600494049ce7ffb695c8cc4 https://git.kernel.org/stable/c/a7ef78a2c536242ccb7a4429da01580b2409bb24

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:39:36.482Z

Updated: 2026-06-25T08:39:36.482Z

Reserved: 2026-06-09T07:44:35.393Z

Link: CVE-2026-53241

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53241 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-26T16:30:03Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object