CVE-2026-98742: Linux Kernel ALSA Sequencer UAF Vulnerability

CVE-2026-98742 Overview

CVE-2026-98742 is a race condition in the Linux kernel's Advanced Linux Sound Architecture (ALSA) sequencer subsystem. The native sequencer ioctl path serializes handler calls with the per-client ioctl_mutex. The translated port-info compat path invokes the same handlers through snd_seq_kernel_client_ctl() without acquiring that mutex. Concurrent compat CREATE_PORT requests can therefore bypass the port-count check and trigger a use-after-free during subscriber teardown. The upstream fix takes ioctl_mutex while dispatching converted port-info requests, matching the native ioctl path.

Critical Impact
A local attacker invoking the 32-bit compat ioctl interface on a 64-bit kernel can race CREATE_PORT operations to produce a duplicate port index, leading to a use-after-free on a freed subscriber object.

Affected Products

Linux kernel ALSA sequencer subsystem (sound/core/seq)
Linux kernel builds with CONFIG_SND_SEQUENCER and CONFIG_COMPAT enabled
Stable kernel branches referenced by commits 2db234e, 413211d, 702d92f, 95b2e03, and fc5c528

Discovery Timeline

2026-10-18 - CVE-2026-98742 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98742

Vulnerability Analysis

The ALSA sequencer exposes an ioctl surface to user space through /dev/snd/seq. The native ioctl entry point serializes all handler invocations using the per-client client->ioctl_mutex. This mutex protects shared client state, including the port table and subscriber lists.

The 32-bit compat ioctl path translates port-info structures from the 32-bit layout to the kernel's native layout, then dispatches the request via snd_seq_kernel_client_ctl(). That helper did not take ioctl_mutex, so compat callers reached the port handlers without the serialization that native callers observed.

Two threads issuing SNDRV_SEQ_IOCTL_CREATE_PORT through the compat path can both pass the port-count ceiling check before either reaches the serialized insertion. The resulting integer port index can exceed the width of the address field and wrap to an index that already identifies a live port.

Root Cause

The root cause is missing lock acquisition in the compat dispatch helper. Serialization that the native path enforced through ioctl_mutex was absent on the translated path. The TOCTOU window between the port-count check and the port insertion allowed two concurrent requests to allocate overlapping identifiers. Later subscriber teardown resolved the duplicated address to the wrong port and dereferenced an already-freed subscriber object.

Attack Vector

An attacker needs local access and permission to open /dev/snd/seq on a kernel built with both CONFIG_SND_SEQUENCER and CONFIG_COMPAT. The attacker launches two or more 32-bit threads that repeatedly issue CREATE_PORT ioctls to the same sequencer client. Winning the race produces a duplicated port index. Follow-up subscriber subscribe or unsubscribe operations then free one subscriber while a dangling pointer remains, enabling a use-after-free that an attacker can shape into memory corruption or local privilege escalation.

No verified public exploit code is available. See the upstream fixes in Kernel Commit 2db234e and Kernel Commit 413211d for the authoritative patch diff.

Detection Methods for CVE-2026-98742

Indicators of Compromise

Kernel oops or KASAN: use-after-free reports originating from snd_seq_* functions in sound/core/seq/
Unexpected process crashes or kernel panics shortly after a local process opens /dev/snd/seq and issues 32-bit compat ioctls
Audit records showing non-privileged processes repeatedly invoking SNDRV_SEQ_IOCTL_CREATE_PORT in tight loops

Detection Strategies

Enable CONFIG_KASAN on test and canary hosts to surface use-after-free conditions in the sequencer subscriber path
Correlate /dev/snd/seq opens with the architecture of the calling binary; 32-bit callers on 64-bit hosts should be rare in server workloads
Alert on repeated CREATE_PORT ioctl bursts from a single PID using eBPF tracing of snd_seq_ioctl

Monitoring Recommendations

Collect dmesg and journald output for KASAN, slub, or general protection fault reports referencing snd_seq_port or snd_seq_subscribers
Monitor loaded kernel modules and ensure snd-seq exposure is limited to hosts that require MIDI functionality
Baseline normal access patterns to /dev/snd/seq and alert on anomalies from non-audio workloads

How to Mitigate CVE-2026-98742

Immediate Actions Required

Apply the stable kernel update that includes commits 2db234e, 413211d, 702d92f, 95b2e03, or fc5c528 for your branch
On systems that do not require MIDI sequencing, blacklist the snd-seq and snd-seq-midi modules
Restrict access to /dev/snd/seq so only trusted users and audio service accounts can open it

Patch Information

The upstream fix extends ioctl_mutex coverage to the compat dispatch helper so that translated port-info commands serialize against native ioctl handlers. Patch references: Kernel Commit 2db234e, Kernel Commit 413211d, Kernel Commit 702d92f, Kernel Commit 95b2e03, and Kernel Commit fc5c528. Rebuild and reboot into the patched kernel to apply.

Workarounds

Prevent autoload of the sequencer module by adding install snd-seq /bin/true to /etc/modprobe.d/
Tighten permissions on /dev/snd/seq through udev rules so the device node is not world-accessible
Disable the 32-bit compat ioctl surface by building kernels without CONFIG_COMPAT where 32-bit userland is not required

bash

# Configuration example: block snd-seq module load and tighten device permissions
echo 'install snd-seq /bin/true' | sudo tee /etc/modprobe.d/blacklist-snd-seq.conf
echo 'install snd-seq-midi /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-snd-seq.conf
sudo rmmod snd_seq_midi snd_seq 2>/dev/null

# Restrict /dev/snd/seq to the audio group only
echo 'KERNEL=="seq", SUBSYSTEM=="sound", GROUP="audio", MODE="0660"' | \
  sudo tee /etc/udev/rules.d/90-restrict-snd-seq.rules
sudo udevadm control --reload-rules && sudo udevadm trigger