All vulnerabilities
CVE-2026-98742

Linux: ALSA: seq: Serialize compat port-info ioctls

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2db234e163f0d211b69a4eebbec8aacc5a54a80eAlso 413211dd31cb2ef2fc99fb0aa1a037a97509502c, 702d92f361f65d9698c473c7599d471395dc4341 and 8 moreCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 2db234e163f0d211b69a4eebbec8aacc5a54a80eLinuxCVE List
  • 413211dd31cb2ef2fc99fb0aa1a037a97509502cLinuxCVE List
  • 702d92f361f65d9698c473c7599d471395dc4341LinuxCVE List
  • 95b2e0361c88753afa030c10698be0a1a5b67650LinuxCVE List
  • 3.3LinuxCVE List
  • 3.17LinuxCVE List
Show all 11 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: Serialize compat port-info ioctls

The native sequencer ioctl path serializes handler calls with client->ioctl_mutex, but the translated port-info compat path invokes the same handlers through snd_seq_kernel_client_ctl() without taking that mutex.

This lets concurrent compat CREATE_PORT requests pass the port-count check before any request reaches the serialized insertion. The computed integer port index can then exceed the address field range and wrap to an existing index. Subsequent subscriber teardown can resolve the duplicate address to the wrong port and access a freed subscriber.

Take ioctl_mutex while dispatching converted port-info requests, matching the native ioctl path. All translated port-info commands share this helper, so their accesses to the client port state are serialized as well.

Text from CVE List

Affected versions 26

  • Linuxaffected: b3defb791b26ea0683a93a4f49c77ec45ec96f10 before 2db234e163f0d211b69a4eebbec8aacc5a54a80eCVE List
  • Linuxaffected: b3defb791b26ea0683a93a4f49c77ec45ec96f10 before 413211dd31cb2ef2fc99fb0aa1a037a97509502cCVE List
  • Linuxaffected: b3defb791b26ea0683a93a4f49c77ec45ec96f10 before fc5c52848e405b6efb073db5035bb9ebaed11ec4CVE List
  • Linuxaffected: b3defb791b26ea0683a93a4f49c77ec45ec96f10 before 702d92f361f65d9698c473c7599d471395dc4341CVE List
  • Linuxaffected: b3defb791b26ea0683a93a4f49c77ec45ec96f10 before 95b2e0361c88753afa030c10698be0a1a5b67650CVE List
  • Linuxaffected: d6693160906d55ba376bf0b88b7c129762170162CVE List
  • Linuxaffected: 02cbce8576a31df8fca54aaec91ee081076bd79dCVE List
  • Linuxaffected: 6aab3aa52366a0051e5abf8aae4616c42053fd8eCVE List
  • Linuxaffected: f8a38ab4cd9624fc5ac8a7f965c7b20f5b62c03cCVE List
  • Linuxaffected: 623e5c8ae32b39cc8baea83478695dc624935318CVE List
  • Linuxaffected: e4ff9f294629b65df3f7982cd4faf86b2856b9d7CVE List
  • Linuxaffected: c3162384aed4cfe3f1a1f40041f3ba8cd7704d88CVE List
  • Linuxaffected: 3.2.99 before 3.3CVE List
  • Linuxaffected: 3.16.54 before 3.17CVE List
  • Linuxaffected: 3.18.94 before 3.19CVE List
  • Linuxaffected: 4.1.50 before 4.2CVE List
  • Linuxaffected: 4.4.115 before 4.5CVE List
  • Linuxaffected: 4.9.78 before 4.10CVE List
  • Linuxaffected: 4.14.15 before 4.15CVE List
  • Linuxaffected: 4.15CVE List
  • Linuxunaffected: all versions before 4.15CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5