{"schema":"threatline.record/2","record":{"id":"CVE-2026-98086","aliases":[],"summary":"ALSA: ump: do not touch legacy_rmidi before it exists","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ump: do not touch legacy_rmidi before it exists\n\nsnd_ump_parse_endpoint() sets ump->parsed on every exit, including\nerror, before the caller attaches the legacy rawmidi device.\nump_handle_ep_name_msg() then treats parsed as \"legacy_rmidi is live\"\nand calls ump_legacy_set_rawmidi_name(), which snprintf()s into\nump->legacy_rmidi->name. If a UMP packet arrives in that window\n(IRQ path from snd_ump_receive), legacy_rmidi is still NULL\n(KASAN null-ptr-deref in snprintf).\n\nGuard the legacy helpers. parsed only means endpoint info was\nparsed, not that legacy_rmidi exists.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98086","source_modified_at":"2026-10-19T09:13:38.462Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"37e0e14128e0685267dc5c037bf655421a6ce2ea","lessThan":"d6f9af093dc91dac8848a01e417b8109c651c0b2","status":"affected","versionType":"git"},{"version":"37e0e14128e0685267dc5c037bf655421a6ce2ea","lessThan":"1c8e01792adf91879322f1ad752f1814de8b7e7d","status":"affected","versionType":"git"},{"version":"37e0e14128e0685267dc5c037bf655421a6ce2ea","lessThan":"228075f31b141395233218712242913125ace4e0","status":"affected","versionType":"git"},{"version":"37e0e14128e0685267dc5c037bf655421a6ce2ea","lessThan":"a4cef20cd473e0640fefd38094d4baac0ec76ae3","status":"affected","versionType":"git"},{"version":"37e0e14128e0685267dc5c037bf655421a6ce2ea","lessThan":"adeee7187694719890aaffdc14b7e89cfd736f1d","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98086","source_modified_at":"2026-10-19T09:13:38.462Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98086","source_modified_at":"2026-10-19T09:13:38.462Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"1c8e01792adf91879322f1ad752f1814de8b7e7d","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98086","source_modified_at":"2026-10-19T09:13:38.462Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"228075f31b141395233218712242913125ace4e0","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.002,"percentile":0.09335,"score_date":"2026-10-23"},"published_at":"2026-09-25T10:24:21.086Z","modified_at":"2026-10-19T09:13:38.462Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98086","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:13:38.462Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98086","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/d6f9af093dc91dac8848a01e417b8109c651c0b2"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/1c8e01792adf91879322f1ad752f1814de8b7e7d"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/228075f31b141395233218712242913125ace4e0"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/a4cef20cd473e0640fefd38094d4baac0ec76ae3"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/adeee7187694719890aaffdc14b7e89cfd736f1d"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:13:38.462Z","content_hash":"89e16344efe0412a8ce37baf9e49de35f4b42e6678037eb4d08c45723bfccc67"}}