CVE-2026-74261 - Vulnerability Details

- ALSA: seq: avoid stale FIFO cells during resize

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: avoid stale FIFO cells during resize

snd_seq_fifo_resize() still needs to publish the replacement pool
before it waits for FIFO users. A blocking snd_seq_read() holds
f->use_lock while it sleeps, so concurrent senders must be able to
queue to the new pool and wake that reader instead of failing against a
closing old pool.

However, snd_seq_fifo_event_in() duplicates an event before it takes
f->lock, and snd_seq_read() can dequeue a cell and later call
snd_seq_fifo_cell_putback() if copy_to_user() or
snd_seq_expand_var_event() fails. If resize swaps f->pool and detaches
oldhead in between, either path can relink an old-pool cell after the
snapshot. That stale cell sits outside the drained oldhead list, keeps
oldpool->counter elevated, and can leave snd_seq_pool_delete() waiting
for the retired pool to drain.

Keep the existing swap-before-wait ordering in snd_seq_fifo_resize(),
but reject stale cells before any FIFO relink. Revalidate event-in cells
under f->lock and retry them against the published replacement pool, and
free stale putback cells instead of linking them back into the FIFO.

The buggy scenario involves two paths, with each column showing the
order within that path:

resize path: relink path:
1. Allocate newpool. 1. Take f->use_lock.
2. Swap f->pool to newpool and 2. Duplicate or dequeue an old-pool
detach oldhead. cell before oldpool closes.
3. Mark oldpool closing and 3. Reach a later relink point after
wait for FIFO users. resize published newpool.
4. Free oldhead and delete 4. Relink the old-pool cell after
oldpool. resize detached oldhead.
5. Drop f->use_lock.

The reproducer reports a resize ioctl blocked in the expected pool
teardown path:

signal: resize iteration=98 target_pool=4 exceeded 250ms
(elapsed=251ms)
diagnostic: resize_tid=651 wchan=snd_seq_pool_done
diagnostic: resize_tid=651 stack=
snd_seq_pool_done+0x5b/0x140
snd_seq_pool_delete+0x7a/0x90
snd_seq_fifo_resize+0x193/0x1e0
snd_seq_ioctl_set_client_pool+0x214/0x260
snd_seq_ioctl+0x119/0x540
__x64_sys_ioctl+0xd1/0x120
do_syscall_64+0xbb/0x2f0
entry_SYSCALL_64_after_hwframe+0x77/0x7f

A second run with larger pools hit the same target path:

signal: resize iteration=32 target_pool=64 exceeded 250ms
(elapsed=251ms)
diagnostic: resize_tid=663 wchan=snd_seq_pool_done
diagnostic: resize_tid=663 stack=
snd_seq_pool_done+0x5b/0x140
snd_seq_pool_delete+0x7a/0x90
snd_seq_fifo_resize+0x193/0x1e0
snd_seq_ioctl_set_client_pool+0x214/0x260
snd_seq_ioctl+0x119/0x540
__x64_sys_ioctl+0xd1/0x120
do_syscall_64+0xbb/0x2f0
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The ALSA sequencer subsystem contains a race in its FIFO resize routine (CWE‑911). When an ioctl resizes the FIFO while other readers or writers are active, stale cells can be left in a deallocated pool. The kernel may then block waiting for these cells to drain, causing the resize operation to hang and resulting in a denial‑of‑service that disables or delays ALSA operations for the affected process.

Affected Systems

The flaw exists in all Linux kernel releases that do not include the commit that introduced proper stale‑cell handling. The CVE references the kernel source and specific commit hashes but does not list explicit version ranges; therefore any kernel version lacking the patch is potentially affected.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a very low exploitation probability. The flaw is not listed in the CISA KEV catalog. It is a local kernel race condition that requires access to the ALSA sequencer device; the likely attack vector is a local user issuing the snd_seq_ioctl_set_client_pool ioctl on /dev/snd/seq (inferred from the description). No remote code execution is possible according to the available data.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2d7d54002e396c180db0c800c1046f0a3c471597`	affected	< 98a965cb1e767b54b6bbd831b6cea26f521a8f51
`2d7d54002e396c180db0c800c1046f0a3c471597`	affected	< 1c4c35fb68d520241f7d9f1c356b5e2370fd8364
`2d7d54002e396c180db0c800c1046f0a3c471597`	affected	< e546128291f8d688dcb931827e2efd2aa6c0734d
`df7a2d0af9f7ab73cf22a7b62bbc0bad93a02110`	affected	—
`28e0ebdd57cd3287ac821068364b74c70af3861c`	affected	—
`d4b8e8a32d74052fe292618ae19f794944ddc673`	affected	—
`e91325f27c4d98d1088e9e86b3ab475f752eeb80`	affected	—
`9ebfed203c0d93449a074c5c2fd5bb3e58518f0d`	affected	—
`3492352e1f34673708fa7409b4b1d97545aa2f1c`	affected	—
`a90d7447e4a154ad26e3b9e09a0878680be49339`	affected	—
`74a2c1ff88a4e0960623d17f7db56ac5a60bb0cf`	affected	—
`c36ef6467420f8982e6d4d6f93d0634a85a5ee45`	affected	—
`3.2.91`	affected	< 3.3
`3.10.107`	affected	< 3.11
`3.12.73`	affected	< 3.13
`3.16.46`	affected	< 3.17
`3.18.50`	affected	< 3.19
`4.1.40`	affected	< 4.2
`4.4.60`	affected	< 4.5
`4.9.21`	affected	< 4.10
`4.10.9`	affected	< 4.11

Linux

affected

Version	Status	Constraints
`4.11`	affected	—
`0`	unaffected	< 4.11
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[2d7d54002e396c180db0c800c1046f0a3c471597,98a965cb1e767b54b6bbd831b6cea26f521a8f51)`	affected	code_commit	—
`[2d7d54002e396c180db0c800c1046f0a3c471597,1c4c35fb68d520241f7d9f1c356b5e2370fd8364)`	affected	code_commit	—
`[2d7d54002e396c180db0c800c1046f0a3c471597,e546128291f8d688dcb931827e2efd2aa6c0734d)`	affected	code_commit	—
`[df7a2d0af9f7ab73cf22a7b62bbc0bad93a02110,df7a2d0af9f7ab73cf22a7b62bbc0bad93a02110]`	affected	code_commit	—
`[28e0ebdd57cd3287ac821068364b74c70af3861c,28e0ebdd57cd3287ac821068364b74c70af3861c]`	affected	code_commit	—
`[d4b8e8a32d74052fe292618ae19f794944ddc673,d4b8e8a32d74052fe292618ae19f794944ddc673]`	affected	code_commit	—
`[e91325f27c4d98d1088e9e86b3ab475f752eeb80,e91325f27c4d98d1088e9e86b3ab475f752eeb80]`	affected	code_commit	—
`[9ebfed203c0d93449a074c5c2fd5bb3e58518f0d,9ebfed203c0d93449a074c5c2fd5bb3e58518f0d]`	affected	code_commit	—
`[3492352e1f34673708fa7409b4b1d97545aa2f1c,3492352e1f34673708fa7409b4b1d97545aa2f1c]`	affected	code_commit	—
`[a90d7447e4a154ad26e3b9e09a0878680be49339,a90d7447e4a154ad26e3b9e09a0878680be49339]`	affected	code_commit	—
`[74a2c1ff88a4e0960623d17f7db56ac5a60bb0cf,74a2c1ff88a4e0960623d17f7db56ac5a60bb0cf]`	affected	code_commit	—
`[c36ef6467420f8982e6d4d6f93d0634a85a5ee45,c36ef6467420f8982e6d4d6f93d0634a85a5ee45]`	affected	code_commit	—
`[3.2.91,3.3)`	affected	semver	—
`[3.10.107,3.11)`	affected	semver	—
`[3.12.73,3.13)`	affected	semver	—
`[3.16.46,3.17)`	affected	semver	—
`[3.18.50,3.19)`	affected	semver	—
`[4.1.40,4.2)`	affected	semver	—
`[4.4.60,4.5)`	affected	semver	—
`[4.9.21,4.10)`	affected	semver	—
`[4.10.9,4.11)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.11`	affected	semver	—
`[0,4.11)`	unaffected	semver	—
`[6.18.40,6.19.0]`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that incorporates the ALSA FIFO resize fix to eliminate the stale‑cell race condition.
If no immediate kernel update is possible, disable or restrict the snd_seq_ioctl_set_client_pool ioctl by disabling the ALSA sequencer service or applying a policy to prevent its use.
Restrict access to ALSA device files (e.g., /dev/snd/*) so that only trusted users can send IOCTLs that interact with the sequencer; enforce this with ACLs or group membership controls.

Generated by OpenCVE AI on August 22, 2026 at 04:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00198.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1c4c35fb68d520241f7d9f1c356b5e2370fd8364
https://git.kernel.org/stable/c/98a965cb1e767b54b6bbd831b6cea26f521a8f51
https://git.kernel.org/stable/c/e546128291f8d688dcb931827e2efd2aa6c0734d
https://lore.kernel.org/linux-cve-announce/2026081542-CVE-2026-74261-f18b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74261
https://www.cve.org/CVERecord?id=CVE-2026-74261

History

Sat, 22 Aug 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-360 CWE-665

Wed, 19 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026081542-CVE-2026-74261-f18b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74261 https://www.cve.org/CVERecord?id=CVE-2026-74261
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sat, 15 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-360 CWE-665

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: avoid stale FIFO cells during resize snd_seq_fifo_resize() still needs to publish the replacement pool before it waits for FIFO users. A blocking snd_seq_read() holds f->use_lock while it sleeps, so concurrent senders must be able to queue to the new pool and wake that reader instead of failing against a closing old pool. However, snd_seq_fifo_event_in() duplicates an event before it takes f->lock, and snd_seq_read() can dequeue a cell and later call snd_seq_fifo_cell_putback() if copy_to_user() or snd_seq_expand_var_event() fails. If resize swaps f->pool and detaches oldhead in between, either path can relink an old-pool cell after the snapshot. That stale cell sits outside the drained oldhead list, keeps oldpool->counter elevated, and can leave snd_seq_pool_delete() waiting for the retired pool to drain. Keep the existing swap-before-wait ordering in snd_seq_fifo_resize(), but reject stale cells before any FIFO relink. Revalidate event-in cells under f->lock and retry them against the published replacement pool, and free stale putback cells instead of linking them back into the FIFO. The buggy scenario involves two paths, with each column showing the order within that path: resize path: relink path: 1. Allocate newpool. 1. Take f->use_lock. 2. Swap f->pool to newpool and 2. Duplicate or dequeue an old-pool detach oldhead. cell before oldpool closes. 3. Mark oldpool closing and 3. Reach a later relink point after wait for FIFO users. resize published newpool. 4. Free oldhead and delete 4. Relink the old-pool cell after oldpool. resize detached oldhead. 5. Drop f->use_lock. The reproducer reports a resize ioctl blocked in the expected pool teardown path: signal: resize iteration=98 target_pool=4 exceeded 250ms (elapsed=251ms) diagnostic: resize_tid=651 wchan=snd_seq_pool_done diagnostic: resize_tid=651 stack= snd_seq_pool_done+0x5b/0x140 snd_seq_pool_delete+0x7a/0x90 snd_seq_fifo_resize+0x193/0x1e0 snd_seq_ioctl_set_client_pool+0x214/0x260 snd_seq_ioctl+0x119/0x540 __x64_sys_ioctl+0xd1/0x120 do_syscall_64+0xbb/0x2f0 entry_SYSCALL_64_after_hwframe+0x77/0x7f A second run with larger pools hit the same target path: signal: resize iteration=32 target_pool=64 exceeded 250ms (elapsed=251ms) diagnostic: resize_tid=663 wchan=snd_seq_pool_done diagnostic: resize_tid=663 stack= snd_seq_pool_done+0x5b/0x140 snd_seq_pool_delete+0x7a/0x90 snd_seq_fifo_resize+0x193/0x1e0 snd_seq_ioctl_set_client_pool+0x214/0x260 snd_seq_ioctl+0x119/0x540 __x64_sys_ioctl+0xd1/0x120 do_syscall_64+0xbb/0x2f0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Title		ALSA: seq: avoid stale FIFO cells during resize
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1c4c35fb68d520241f7d9f1c356b5e2370fd8364 https://git.kernel.org/stable/c/98a965cb1e767b54b6bbd831b6cea26f521a8f51 https://git.kernel.org/stable/c/e546128291f8d688dcb931827e2efd2aa6c0734d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:57:38.311Z

Updated: 2026-08-17T05:16:03.389Z

Reserved: 2026-08-15T05:44:03.877Z

Link: CVE-2026-74261

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:25.307

Modified: 2026-08-17T06:19:19.603

Link: CVE-2026-74261

Redhat

Severity : Low

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74261 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T05:00:13Z

Weaknesses

CWE-911
Improper Update of Reference Count

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object