Cloudanix VulnDB

CVE-2026-98912

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A mistake in how the system decides whether a music or MIDI event will fit in a program's memory buffer can cause events to be skipped or programs to receive more data than they asked for.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Inverted buffer-size check in snd_seq_oss_read allows an event larger than the remaining userspace read buffer to be copied anyway, or prevents a correctly-sized event from ever being returned.

Why it matters to the business

Applications that read ALSA sequencer data with modest buffers can receive truncated or corrupted event streams, leading to lost MIDI/sequencer events, application crashes, or silent data loss on audio/MIDI systems.

How an attack unfolds

A local user opens /dev/snd/seq or equivalent OSS sequencer device and issues repeated reads with a buffer smaller than the next queued event; the inverted check either returns early (appearing as EOF) or copies the oversized event, potentially overflowing the caller's buffer.

How to fix it

Upgrade to a kernel containing the corrected snd_seq_oss_read logic; no configuration workaround exists.

How to confirm the fix worked

Confirm the kernel source contains the corrected break condition that only stops when remaining buffer < next event size and returns -EINVAL when no complete event was copied.

Typical attack path

  1. Open OSS sequencer device for reading
  2. Queue or wait for events larger than chosen read buffer
  3. Issue read with undersized buffer
  4. Receive either no data or data exceeding buffer length

How to detect it

Review kernel audit logs or application logs for unexpected -EINVAL returns from sequencer reads or for read lengths that do not match expected OSS event sizes; no public exploit artifacts exist.

What your security team should do

  • Patch Linux kernel to the fixed version as soon as it is available in your distribution
  • Monitor upstream stable and distribution security feeds for the ALSA sequencer fix
  • Limit untrusted local accounts' access to sequencer devices until patched

The record

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue. The check is inverted. It currently stops when the event is smaller than the remaining buffer, so a normal 4-byte event is not copied for an 8-byte read buffer. Conversely, an 8-byte event can be copied for a smaller read count. Break only when the remaining userspace buffer is smaller than the next event, and report -EINVAL if no complete event has been copied. This prevents an undersized read from looking like end-of-file while leaving the event queued for a later read with a large enough buffer.

Affected packages

Ecosystem Package Introduced Fixed