{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98912 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-98912 is a vulnerability in Linux, published on 23 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-98912 and fix it if it is affected.\n\nWhat it is: CVE-2026-98912 is a vulnerability in Linux, published on 23 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-98912 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98912/ (Markdown: https://insights.sbomify.com/CVE-2026-98912/index.md)","id":"CVE-2026-98912","markdown":"https://insights.sbomify.com/CVE-2026-98912/index.md","name":"CVE-2026-98912","record":{"aliases":["AZL-110680","BELL-CVE-2026-98912","DEBIAN-CVE-2026-98912","GHSA-c2vm-8x7j-h34j","UBUNTU-CVE-2026-98912"],"analysis":null,"analysis_generated_by":null,"assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: oss: Reject reads that cannot fit the next event\n\nsnd_seq_oss_read() checks whether the next queued OSS sequencer event\nfits in the remaining userspace buffer before removing it from the read\nqueue.\n\nThe check is inverted. It currently stops when the event is smaller than\nthe remaining buffer, so a normal 4-byte event is not copied for an\n8-byte read buffer. Conversely, an 8-byte event can be copied for a\nsmaller read count.\n\nBreak only when the remaining userspace buffer is smaller than the next\nevent, and report -EINVAL if no complete event has been copied. This\nprevents an undersized read from looking like end-of-file while leaving\nthe event queued for a later read with a large enough buffer.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ALSA: seq: oss: Reject reads that cannot fit the next event","id":"CVE-2026-98912","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":7,"next":{"headline":"net: thunderx: fix PTP device ref leak in nicvf_probe()","id":"CVE-2026-98913"},"packages":[],"prev":{"headline":"dpaa2-switch: fix the error path in dpaa2_switch_rx()","id":"CVE-2026-98911"},"products":["Linux"],"published":"2026-10-23","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-26","vendors":["Linux"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-98912/"}