CVE-2026-64479 Overview
CVE-2026-64479 is a Linux kernel information disclosure vulnerability in the Advanced Linux Sound Architecture (ALSA) sequencer subsystem. The flaw resides in snd_seq_event_dup(), which fails to zero the trailing cell->ump.raw.extra word when a legacy event is copied into a Universal MIDI Packet (UMP) cell. Because the cell pool is allocated with kvmalloc() and reused via a free list, the uninitialised word retains stale heap data. An unprivileged process holding a /dev/snd/seq file descriptor can read this data as part of a larger snd_seq_ump_event structure, leaking 4 bytes of kernel memory per event.
Critical Impact
Local unprivileged users can leak kernel heap contents through the ALSA sequencer interface, aiding kernel exploitation by defeating address randomization.
Affected Products
- Linux kernel builds with CONFIG_SND_SEQ_UMP enabled
- Distributions shipping the ALSA sequencer with UMP support prior to the linked stable commits
- Systems exposing /dev/snd/seq to unprivileged users (typical desktop configurations)
Discovery Timeline
- 2026-07-25 - CVE-2026-64479 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64479
Vulnerability Analysis
The ALSA sequencer allocates event cells from a pool to buffer MIDI events between clients. When UMP support is compiled in, each cell contains a ump union larger than the legacy snd_seq_event structure. The snd_seq_event_dup() function copies an incoming event into a cell and then attempts to clear the trailing bytes not covered by the memcpy() call.
The guard condition compares the copied size against sizeof(cell->event). For a legacy event, that size is exactly equal to sizeof(cell->event), so the branch that clears cell->ump.raw.extra is skipped. The trailing 4-byte word retains whatever data the previous cell owner left there, or uninitialised heap contents from the initial kvmalloc() allocation.
When the cell is delivered to a UMP-aware client whose midi_version is greater than zero and which set the SNDRV_SEQ_FILTER_NO_CONVERT flag, the legacy event is not converted. The subsequent snd_seq_read() returns the larger snd_seq_ump_event structure to userspace, including the stale word.
Root Cause
The root cause is an incorrect size comparison [CWE-908 Use of Uninitialized Resource]. The guard uses sizeof(cell->event) instead of sizeof(cell->ump), causing the zero-initialisation to be skipped for legacy events that fit exactly within the smaller structure. The fix compares against sizeof(cell->ump) so the trailing word is cleared for every event shorter than the UMP cell.
Attack Vector
Exploitation requires local access to /dev/snd/seq, which is generally available to members of the audio group or via desktop session policies. The attacker creates a sequencer client, negotiates a UMP midi_version greater than zero, sets SNDRV_SEQ_FILTER_NO_CONVERT, and receives legacy events from any sender. Each delivered event yields 4 bytes of kernel heap data. Repeated event delivery can be used to sweep the pool and reconstruct sensitive kernel addresses or leftover event contents.
The vulnerability manifests entirely within the kernel's ALSA sequencer code path; see the referenced Kernel Git Commit 435990e for the patched logic.
Detection Methods for CVE-2026-64479
Indicators of Compromise
- Unprivileged processes opening /dev/snd/seq and creating sequencer clients with UMP midi_version set to a non-zero value
- Processes issuing SNDRV_SEQ_IOCTL_SET_CLIENT_FILTER with the SNDRV_SEQ_FILTER_NO_CONVERT bit and reading events in a tight loop
- Kernel builds where the running version predates the fix commits while CONFIG_SND_SEQ_UMP=y
Detection Strategies
- Audit kernel version and configuration across the fleet to identify hosts running vulnerable ALSA sequencer code
- Monitor open() and ioctl() syscalls targeting /dev/snd/seq from non-audio processes using auditd or eBPF-based sensors
- Correlate high-volume sequencer reads from a single unprivileged process, which is atypical for legitimate audio workloads
Monitoring Recommendations
- Enable syscall auditing for /dev/snd/seq access and alert on unusual client processes
- Track kernel package versions in a centralized inventory and flag hosts missing the patch commits
- Review desktop and container images for unnecessary exposure of ALSA sequencer devices to untrusted workloads
How to Mitigate CVE-2026-64479
Immediate Actions Required
- Apply the upstream kernel patches referenced in the NVD entry as soon as vendor packages are available
- Restrict /dev/snd/seq access to trusted users where audio functionality is not required, particularly on multi-tenant or server systems
- Rebuild custom kernels with the fix backported if distribution updates are delayed
Patch Information
The fix replaces the size comparison in snd_seq_event_dup() so the trailing UMP word is zeroed for every event shorter than the UMP cell. The corrected logic compares against sizeof(cell->ump) instead of sizeof(cell->event). Patched commits are available across stable branches: 435990e, 651ba82, 6ded426, a224c84, d7649aa, ea672a9, and fb1aa50.
Workarounds
- Disable UMP support by building the kernel without CONFIG_SND_SEQ_UMP where feasible
- Remove or blacklist the snd_seq module on systems that do not require MIDI sequencing
- Tighten permissions on /dev/snd/seq via udev rules to limit access to trusted local users only
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
