{"cve":"CVE-2026-74278","nvd":{"published":"2026-08-15T06:22:27.213","modified":"2026-10-21T13:19:41.117","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix kernel heap address leak in bounce_error_event()\n\nThe comment above bounce_error_event() documents that user clients\nshould receive SNDRV_SEQ_EVENT_BOUNCE with the original event embedded\nas variable-length data, while kernel clients should receive\nSNDRV_SEQ_EVENT_KERNEL_ERROR with a quoted kernel pointer.\n\nHowever, the implementation unconditionally uses\nSNDRV_SEQ_EVENT_KERNEL_ERROR with data.quote.event set to the raw\nstruct snd_seq_event pointer for all clients.  When a bounce error\nevent is delivered to a USER_CLIENT via snd_seq_read(), the kernel\nheap address in data.quote.event is exposed to userspace through\ncopy_to_user() in the fixed-length branch.\n\nThis is a distinct leak path from the one addressed by commit\n705dd6dcbc0e (\"ALSA: seq: Clear variable event pointer on read\"),\nwhich sanitizes data.ext.ptr in the variable-length branch of\nsnd_seq_read().  The bounce_error_event() leak uses fixed-length\nevents that take the else branch where no sanitization occurs.\n\nDifferentiate the bounce event by client type.  For USER_CLIENT,\nsend SNDRV_SEQ_EVENT_BOUNCE with SNDRV_SEQ_EVENT_LENGTH_VARIABLE\nand data.ext pointing to the original event.  The variable-length\npath in snd_seq_event_dup() copies the event data into chained\ncells, and snd_seq_expand_var_event() copies only the content --\nnever the pointer -- to userspace.  For KERNEL_CLIENT, keep the\nexisting SNDRV_SEQ_EVENT_KERNEL_ERROR behavior with the quoted\npointer.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/0527a56cb327021cb73167cfddf0e49efa043500","https://git.kernel.org/stable/c/93d260ce43a81df579c98bee92b91316df9c1c57","https://git.kernel.org/stable/c/dae23c545eb5a2be3b27a82fd0f611894fb8ab69","https://git.kernel.org/stable/c/eae296065ede41a24040e6a7c909ec970f78b4eb","https://git.kernel.org/stable/c/efc86691e4d8083d9e380ea95042c2cf679f65fd"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-74278","score":0.00168,"percentile":0.06055,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}