Cloudanix VulnDB

CVE-2026-98742

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in audio handling code could let certain programs cause memory errors on Linux systems, but the issue is hard to exploit and unlikely to affect most users right away.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in ALSA sequencer compat ioctl handling bypasses client->ioctl_mutex serialization on CREATE_PORT, allowing concurrent requests to exceed port-count limits, wrap the port index, and cause use-after-free during subscriber teardown on duplicate addresses.

Why it matters to the business

Low-probability kernel instability or memory corruption risk on Linux systems exposing ALSA sequencer to 32-bit compat applications; recent disclosure with stable low exploit probability means minimal immediate operational disruption unless local untrusted code is present.

How an attack unfolds

An attacker with local access issues multiple concurrent compat CREATE_PORT ioctls to race past the port-count check, forcing an integer wrap to an existing port index; subsequent subscriber teardown operations then dereference the stale address and access freed memory.

How to fix it

Apply the upstream kernel patch that acquires ioctl_mutex for all translated port-info compat requests; update to a fixed kernel release once available and rebuild any custom ALSA-enabled distributions.

How to confirm the fix worked

Inspect kernel source for snd_seq_compat_* helpers confirming ioctl_mutex acquisition before calling snd_seq_kernel_client_ctl(); verify absence of the race by reviewing commit history for the serialization change.

Typical attack path

  1. Obtain local unprivileged access on a Linux system using ALSA sequencer
  2. Issue concurrent compat-mode port creation ioctls to bypass serialization
  3. Trigger port index wraparound to duplicate an existing address
  4. Perform subscriber teardown to induce use-after-free access

How to detect it

Review system call audit logs or strace output for clusters of compat ALSA sequencer ioctls from the same process; correlate with kernel oops or use-after-free warnings referencing seq or subscriber structures.

What your security team should do

  • Prioritize kernel updates on systems with ALSA sequencer exposure within standard patch cycles
  • Limit untrusted local code execution on audio-capable hosts
  • Monitor EPSS and exploit maturity indicators for any future rise

The record

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path serializes handler calls with client->ioctl_mutex, but the translated port-info compat path invokes the same handlers through snd_seq_kernel_client_ctl() without taking that mutex. This lets concurrent compat CREATE_PORT requests pass the port-count check before any request reaches the serialized insertion. The computed integer port index can then exceed the address field range and wrap to an existing index. Subsequent subscriber teardown can resolve the duplicate address to the wrong port and access a freed subscriber. Take ioctl_mutex while dispatching converted port-info requests, matching the native ioctl path. All translated port-info commands share this helper, so their accesses to the client port state are serialized as well.

Affected packages

Ecosystem Package Introduced Fixed