CVE-2026-64029: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64029 Overview

CVE-2026-64029 is a use-after-free vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) sequencer Universal MIDI Packet (UMP) subsystem. The flaw exists in seq_ump_process_event(), which accesses client->out_rfile.output without synchronizing against first-open and last-close transitions in seq_ump_client_open() and seq_ump_client_close(). A race between the event input path and the last output teardown path can free the rawmidi substream runtime while snd_rawmidi_kernel_write() is still executing. KASAN reproduced this as a slab-use-after-free in snd_rawmidi_kernel_write1().

Critical Impact
A local attacker with permission to open ALSA sequencer devices can trigger a slab use-after-free in kernel memory, enabling privilege escalation or denial of service.

Affected Products

Linux kernel versions containing the ALSA sequencer UMP client implementation in sound/core/seq/seq_ump_client.c
Distributions shipping vulnerable kernels prior to the fix commits
Systems exposing /dev/snd/seq to unprivileged users

Discovery Timeline

2026-07-19 - CVE-2026-64029 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64029

Vulnerability Analysis

The vulnerability resides in the ALSA sequencer's UMP client code path. When a client dispatches a sequencer event, seq_ump_process_event() reads the borrowed output rawmidi file from client->out_rfile.output and passes it into snd_rawmidi_kernel_write(). This read is unsynchronized with the reference counting that governs the lifetime of the underlying rawmidi substream.

Concurrently, the last output unuse operation can decrement opened[STR_OUT] to zero. Once that counter drops to zero, snd_rawmidi_kernel_release() closes the file and close_substream() frees substream->runtime. If the write path has not yet acquired its own buffer reference on the runtime, the writer continues to dereference a freed substream.

KASAN observed the resulting slab-use-after-free during snd_rawmidi_kernel_write1(), with the allocation originating from seq_ump_use()/snd_seq_port_connect() and the free from seq_ump_unuse()/snd_seq_port_disconnect().

Root Cause

The root cause is missing synchronization between the event input path and the output teardown path. The borrowed output file reference in client->out_rfile.output had no locking protecting its visibility window against concurrent last-close teardown. Because event_input can be reached from atomic sequencer delivery, the fix requires IRQ-safe synchronization.

Attack Vector

Exploitation requires local access with permission to open ALSA sequencer devices. An attacker races two threads: one issues write() calls that drive snd_seq_write() into seq_ump_process_event(), while another closes the UMP output endpoint to trigger the last-unuse teardown. Winning the race frees the rawmidi runtime while it is still referenced by the writer, producing a use-after-free that can be shaped into kernel memory corruption.

The upstream fix introduces a per-client rwlock protecting the event-input-visible output file. New output files are published under the write side, while lookup and snd_rawmidi_kernel_write() execute under the read side. See the fix commits 0cb1ad79, 3aab4a58, 60a1969f, 8ba1c4dd, and ef46b616 for the corrective serialization.

Detection Methods for CVE-2026-64029

Indicators of Compromise

KASAN reports containing slab-use-after-free in snd_rawmidi_kernel_write1 in kernel logs
Unexpected kernel oops or panic traces including seq_ump_process_event, snd_seq_deliver_from_ump, or snd_rawmidi_kernel_write frames
Unprivileged processes opening /dev/snd/seq and /dev/snd/umpC* in rapid open/close patterns

Detection Strategies

Enable KASAN or KFENCE on test kernels to surface use-after-free conditions in the ALSA subsystem during fuzzing
Monitor dmesg for stack traces referencing seq_ump_client.c around lines matching seq_ump_process_event+0xd4
Correlate audit logs of ALSA device access with subsequent kernel crash telemetry to identify race exploitation attempts

Monitoring Recommendations

Ship kernel ring buffer output to centralized logging and alert on KASAN, BUG:, or Oops strings
Track process behavior for local users interacting with /dev/snd/seq when audio workloads are not expected
Baseline system stability metrics to detect anomalous kernel panics on multi-user hosts

How to Mitigate CVE-2026-64029

Immediate Actions Required

Apply the upstream kernel patches referenced by the fix commits or update to a distribution kernel that includes them
Restrict access to /dev/snd/seq and related nodes to trusted users through group membership and udev rules
Prioritize patching on multi-tenant hosts and shared workstations where local users are present

Patch Information

The fix serializes UMP output teardown with event_input by introducing a per-client rwlock in sound/core/seq/seq_ump_client.c. The patch is available in the stable kernel commits 0cb1ad79, 3aab4a58, 60a1969f, 8ba1c4dd, and ef46b616.

Workarounds

Blacklist the snd_seq and snd_ump kernel modules on systems that do not require MIDI sequencer functionality
Remove read/write permissions on /dev/snd/seq for untrusted local accounts using udev rules and file ACLs
Deploy kernel lockdown or seccomp policies that block MIDI sequencer access for sandboxed workloads

bash

# Configuration example: disable ALSA sequencer modules where not required
echo 'blacklist snd_seq' | sudo tee /etc/modprobe.d/blacklist-snd-seq.conf
echo 'blacklist snd_seq_midi' | sudo tee -a /etc/modprobe.d/blacklist-snd-seq.conf
sudo depmod -a

# Restrict device access for non-audio users
sudo chmod 660 /dev/snd/seq
sudo chown root:audio /dev/snd/seq