CVE-2026-74339 ALSA: seq: Clear variable event pointer on read
A local attacker can read kernel memory addresses via ALSA sequencer events, potentially aiding further exploitation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74339?
CVE-2026-74339 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: Clear variable event pointer on read
snd_seq_read() copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRV_SEQ_EXT_CHAINED internally, and data.ext.ptr points at the first extension cell.
The read side strips SNDRV_SEQ_EXT_* bits from data.ext.len before the copy, but it leaves data.ext.ptr untouched. A userspace sequencer client can therefore write a direct variable event to itself and read back the extension-cell kernel address from the returned header.
Clear the temporary header pointer before copy_to_user(). The original queued event remains unchanged and is still passed to snd_seq_expand_var_event(), so payload expansion keeps using the internal chain.
Which versions are affected by CVE-2026-74339?
How do I fix CVE-2026-74339?
Apply the vendor's patch.
Is CVE-2026-74339 being exploited?
There is no known exploitation of CVE-2026-74339 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74339, DEBIAN-CVE-2026-74339, GHSA-5rp2-cp2v-9mcx, UBUNTU-CVE-2026-74339.