{"id":"CVE-2026-74339","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-74339","generatedAt":"2026-10-28T02:14:16.004Z","title":"In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read snd_seq_read() copies a queued variable-length event header to userspace before expanding the payload.","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Clear variable event pointer on read\n\nsnd_seq_read() copies a queued variable-length event header to userspace\nbefore expanding the payload. Queued variable-length events use\nSNDRV_SEQ_EXT_CHAINED internally, and data.ext.ptr points at the first\nextension cell.\n\nThe read side strips SNDRV_SEQ_EXT_* bits from data.ext.len before the\ncopy, but it leaves data.ext.ptr untouched. A userspace sequencer client\ncan therefore write a direct variable event to itself and read back the\nextension-cell kernel address from the returned header.\n\nClear the temporary header pointer before copy_to_user(). The original\nqueued event remains unchanged and is still passed to\nsnd_seq_expand_var_event(), so payload expansion keeps using the\ninternal chain.","published":"2026-08-15T06:22:35.000Z","lastModified":"2026-08-17T06:19:28.000Z","status":"Received","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","cvss":null,"cwe":[],"affected":[],"epss":{"score":0.00215,"percentile":0.11733,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"unknown","text":"Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published."},"changes":[],"references":[{"url":"https://git.kernel.org/stable/c/14fe4f75fd5309d6b75f8e840ada88912b374207","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b52211eba213c461f68922708a99d8190c1fcd5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/705dd6dcbc0ea87351c660c1a6443f85f1001c76","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74ac1ce1f4afdb3b80b6742fa28fb86c8c51d31b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2ac9287e89916da684c2a548798351e63eb59ee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e0c3edd86414534cfd179fefe45b38c29c01ae7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f29243c211928114f8b906e0a3fee77c236f14c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-74339","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}