CVE-2026-74339
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read snd_seq_read() copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRV_SEQ_EXT_CHAINED internally, and data.ext.ptr points at the first extension cell. The read side strips SNDRV_SEQ_EXT_* bits from data.ext.len before the copy, but it leaves data.ext.ptr untouched. A userspace sequencer client can therefore write a direct variable event to itself and read back the extension-cell kernel address from the returned header. Clear the temporary header pointer before copy_to_user(). The original queued event remains unchanged and is still passed to snd_seq_expand_var_event(), so payload expansion keeps using the internal chain.
Affected versions
Linux kernel versions
2.6.12
and later are affected. Fixed in
5.15.212,
6.1.178,
6.6.145,
6.12.97,
6.18.40,
7.1.5,
7.2-rc1
and their respective stable series.
References
7 totalFrequently asked questions
-
What is CVE-2026-74339?
CVE-2026-74339 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.12 onward and has been patched in 5.15.212, 6.1.178, 6.6.145 and others. CVE-2026-74339 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-74339?
Yes. CVE-2026-74339 has been patched. Fixed versions include 5.15.212, 6.1.178, 6.6.145 and others. If you are running Linux kernel 2.6.12 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-74339 actively exploited?
No. CVE-2026-74339 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.