{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98086 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98086 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98086 and fix it if it is affected.\n\nWhat it is: CVE-2026-98086 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98086 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98086/ (Markdown: https://insights.sbomify.com/CVE-2026-98086/index.md)","id":"CVE-2026-98086","markdown":"https://insights.sbomify.com/CVE-2026-98086/index.md","name":"CVE-2026-98086","record":{"aliases":["AZL-104622","BELL-CVE-2026-98086","DEBIAN-CVE-2026-98086","GHSA-54q5-26wc-pgp6","UBUNTU-CVE-2026-98086"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel ALSA","requires_auth":"none","summary":"A null pointer dereference in the Linux kernel ALSA UMP driver allows local attackers to cause a system crash via crafted UMP packets.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ump: do not touch legacy_rmidi before it exists\n\nsnd_ump_parse_endpoint() sets ump-\u003eparsed on every exit, including\nerror, before the caller attaches the legacy rawmidi device.\nump_handle_ep_name_msg() then treats parsed as \"legacy_rmidi is live\"\nand calls ump_legacy_set_rawmidi_name(), which snprintf()s into\nump-\u003elegacy_rmidi-\u003ename. If a UMP packet arrives in that window\n(IRQ path from snd_ump_receive), legacy_rmidi is still NULL\n(KASAN null-ptr-deref in snprintf).\n\nGuard the legacy helpers. parsed only means endpoint info was\nparsed, not that legacy_rmidi exists.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ALSA: ump: do not touch legacy_rmidi before it exists","id":"CVE-2026-98086","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate","id":"CVE-2026-98087"},"packages":[],"prev":{"headline":"bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge","id":"CVE-2026-98085"},"products":["Linux"],"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A null pointer dereference in the Linux kernel ALSA UMP driver allows local attackers to cause a system crash via crafted UMP packets.","url":"https://insights.sbomify.com/CVE-2026-98086/"}