CVE-2026-64479 - Vulnerability Details

- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()

snd_seq_event_dup() copies an incoming event into a pool cell and, in
the UMP-enabled build, clears the trailing cell->ump.raw.extra word that
the memcpy() did not cover. The guard deciding whether to clear it
compares the copied size against sizeof(cell->event):

memcpy(&cell->ump, event, size);
if (size < sizeof(cell->event))
cell->ump.raw.extra = 0;

For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) ==
sizeof(cell->event), so the condition is false and the extra word keeps
stale data. The cell pool is allocated with kvmalloc() (not zeroed) and
cells are reused via a free list, so that word holds uninitialised heap
or leftover event data.

When such a cell is delivered to a UMP client (client->midi_version > 0)
that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it
unconverted -- snd_seq_read() reads it out as the larger struct
snd_seq_ump_event and copies the stale word to user space, a 4-byte
kernel heap infoleak to an unprivileged /dev/snd/seq client.

Compare against sizeof(cell->ump) instead, so the trailing word is zeroed
for every event shorter than the UMP cell.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel ALSA sequencer subsystem contains an uninitialised 4‑byte heap field that is copied into user space for certain legacy events. When an older (non‑UMP) event is sent to a UMP client that suppresses conversion, the stale word is copied to the user buffer, leaking a small amount of kernel memory to an unprivileged /dev/snd/seq client. This is an uninitialised memory read (CWE‑908) and results in a kernel‑heap information leak.

Affected Systems

All Linux kernel builds that include the ALSA sequencing subsystem with UMP enabled are potentially affected. No specific kernel versions are listed, so any recent kernel incorporating the ALSA UMP feature without the applied fix could be vulnerable.

Risk and Exploitability

The CVSS score of 5.5 indicates medium severity, reflecting a kernel‑heap information leak. The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting low likelihood of exploitation. However, an attacker requires local user access to /dev/snd/seq, a kernel with UMP support, a legacy event, and a client that sets SNDRV_SEQ_FILTER_NO_CONVERT. These preconditions are narrow, but the leakage of uninitialised heap data to user space justifies prompt remediation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6389f2c135311c4ce7c08c3b29145c8f95aacf1f`	affected	< d7649aa11089a93ea2285c210397aa67e5800766
`d7e2ce72833bb23a82b4201fbed7214cc04a4a8c`	affected	< a224c84e5d3d35708c082c84ad12d81d90762195
`46397622a3fa8372b8fda0f04b33d16923b03b1b`	affected	< ea672a9f6cc38f06fe69dd2c257ef8a3d4db179a
`46397622a3fa8372b8fda0f04b33d16923b03b1b`	affected	< fb1aa5082847b98f44f9c6272aee9d0dca9244f0
`46397622a3fa8372b8fda0f04b33d16923b03b1b`	affected	< 651ba82fe2a144bc7356d940bfd235c3810b0549
`46397622a3fa8372b8fda0f04b33d16923b03b1b`	affected	< 6ded42615fa1f4949925afd0a8a9e1ab3bf96202
`46397622a3fa8372b8fda0f04b33d16923b03b1b`	affected	< 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4

Linux

affected

Version	Status	Constraints
`6.5`	affected	—
`0`	unaffected	< 6.5
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6389f2c135311c4ce7c08c3b29145c8f95aacf1f,d7649aa11089a93ea2285c210397aa67e5800766)`	affected	code_commit	—
`[d7e2ce72833bb23a82b4201fbed7214cc04a4a8c,a224c84e5d3d35708c082c84ad12d81d90762195)`	affected	code_commit	—
`[46397622a3fa8372b8fda0f04b33d16923b03b1b,ea672a9f6cc38f06fe69dd2c257ef8a3d4db179a)`	affected	code_commit	—
`[46397622a3fa8372b8fda0f04b33d16923b03b1b,fb1aa5082847b98f44f9c6272aee9d0dca9244f0)`	affected	code_commit	—
`[46397622a3fa8372b8fda0f04b33d16923b03b1b,651ba82fe2a144bc7356d940bfd235c3810b0549)`	affected	code_commit	—
`[46397622a3fa8372b8fda0f04b33d16923b03b1b,6ded42615fa1f4949925afd0a8a9e1ab3bf96202)`	affected	code_commit	—
`[46397622a3fa8372b8fda0f04b33d16923b03b1b,435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.5`	affected	semver	—
`[0,6.5)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the vendor patch that clears the 4‑byte word when copying events into the pool cell.
If a kernel upgrade cannot be performed, rebuild or reconfigure the kernel with CONFIG_SND_SEQ_UMP disabled, or remove UMP support entirely.
Configure clients so that SNDRV_SEQ_FILTER_NO_CONVERT is not set, preventing legacy events from bypassing conversion.
Restrict access to /dev/snd/seq to privileged users to limit exposure to ordinary unprivileged processes.

Generated by OpenCVE AI on August 2, 2026 at 12:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00181.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4
https://git.kernel.org/stable/c/651ba82fe2a144bc7356d940bfd235c3810b0549
https://git.kernel.org/stable/c/6ded42615fa1f4949925afd0a8a9e1ab3bf96202
https://git.kernel.org/stable/c/a224c84e5d3d35708c082c84ad12d81d90762195
https://git.kernel.org/stable/c/d7649aa11089a93ea2285c210397aa67e5800766
https://git.kernel.org/stable/c/ea672a9f6cc38f06fe69dd2c257ef8a3d4db179a
https://git.kernel.org/stable/c/fb1aa5082847b98f44f9c6272aee9d0dca9244f0
https://lore.kernel.org/linux-cve-announce/2026072547-CVE-2026-64479-d0d2@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64479
https://www.cve.org/CVERecord?id=CVE-2026-64479

History

Sat, 01 Aug 2026 01:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-788

Tue, 28 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-908
References		https://lore.kernel.org/linux-cve-announce/2026072547-CVE-2026-64479-d0d2@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64479 https://www.cve.org/CVERecord?id=CVE-2026-64479
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 26 Jul 2026 01:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-788

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() snd_seq_event_dup() copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell->ump.raw.extra word that the memcpy() did not cover. The guard deciding whether to clear it compares the copied size against sizeof(cell->event): memcpy(&cell->ump, event, size); if (size < sizeof(cell->event)) cell->ump.raw.extra = 0; For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) == sizeof(cell->event), so the condition is false and the extra word keeps stale data. The cell pool is allocated with kvmalloc() (not zeroed) and cells are reused via a free list, so that word holds uninitialised heap or leftover event data. When such a cell is delivered to a UMP client (client->midi_version > 0) that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it unconverted -- snd_seq_read() reads it out as the larger struct snd_seq_ump_event and copies the stale word to user space, a 4-byte kernel heap infoleak to an unprivileged /dev/snd/seq client. Compare against sizeof(cell->ump) instead, so the trailing word is zeroed for every event shorter than the UMP cell.
Title		ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 https://git.kernel.org/stable/c/651ba82fe2a144bc7356d940bfd235c3810b0549 https://git.kernel.org/stable/c/6ded42615fa1f4949925afd0a8a9e1ab3bf96202 https://git.kernel.org/stable/c/a224c84e5d3d35708c082c84ad12d81d90762195 https://git.kernel.org/stable/c/d7649aa11089a93ea2285c210397aa67e5800766 https://git.kernel.org/stable/c/ea672a9f6cc38f06fe69dd2c257ef8a3d4db179a https://git.kernel.org/stable/c/fb1aa5082847b98f44f9c6272aee9d0dca9244f0

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:51:41.006Z

Updated: 2026-07-25T08:51:41.006Z

Reserved: 2026-07-19T15:36:31.791Z

Link: CVE-2026-64479

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-07-25T10:17:33.493

Modified: 2026-07-25T10:17:33.493

Link: CVE-2026-64479

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64479 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-02T12:30:05Z

Weaknesses

CWE-908
Use of Uninitialized Resource

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object