Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64479— ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于snd_seq_event_dup()函数在处理遗留事件时未正确清零cell->ump.raw.extra，导致未初始化的堆数据泄露至用户空间，攻击者可能通过/dev/snd/seq客户端获取4字节内核堆信息。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux 6389f2c135311c4ce7c08c3b29145c8f95aacf1f< d7649aa11089a93ea2285c210397aa67e5800766 affected
d7e2ce72833bb23a82b4201fbed7214cc04a4a8c< a224c84e5d3d35708c082c84ad12d81d90762195 affected
46397622a3fa8372b8fda0f04b33d16923b03b1b< ea672a9f6cc38f06fe69dd2c257ef8a3d4db179a affected
46397622a3fa8372b8fda0f04b33d16923b03b1b< fb1aa5082847b98f44f9c6272aee9d0dca9244f0 affected
46397622a3fa8372b8fda0f04b33d16923b03b1b< 651ba82fe2a144bc7356d940bfd235c3810b0549 affected
46397622a3fa8372b8fda0f04b33d16923b03b1b< 6ded42615fa1f4949925afd0a8a9e1ab3bf96202 affected
46397622a3fa8372b8fda0f04b33d16923b03b1b< 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 affected
6.5 affected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64479

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() snd_seq_event_dup() copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell->ump.raw.extra word that the memcpy() did not cover. The guard deciding whether to clear it compares the copied size against sizeof(cell->event): memcpy(&cell->ump, event, size); if (size < sizeof(cell->event)) cell->ump.raw.extra = 0; For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) == sizeof(cell->event), so the condition is false and the extra word keeps stale data. The cell pool is allocated with kvmalloc() (not zeroed) and cells are reused via a free list, so that word holds uninitialised heap or leftover event data. When such a cell is delivered to a UMP client (client->midi_version > 0) that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it unconverted -- snd_seq_read() reads it out as the larger struct snd_seq_ump_event and copies the stale word to user space, a 4-byte kernel heap infoleak to an unprivileged /dev/snd/seq client. Compare against sizeof(cell->ump) instead, so the trailing word is zeroed for every event shorter than the UMP cell.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于snd_seq_event_dup()函数在处理遗留事件时未正确清零cell->ump.raw.extra，导致未初始化的堆数据泄露至用户空间，攻击者可能通过/dev/snd/seq客户端获取4字节内核堆信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 6389f2c135311c4ce7c08c3b29145c8f95aacf1f ~ d7649aa11089a93ea2285c210397aa67e5800766 -
Linux Linux 6.5 -

II. Public POCs for CVE-2026-64479

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64479

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64479 (7)

Same Patch Batch · Linux · 2026-07-25 · 274 CVEs total

CVE-2026-64355 9.8 CRITICAL bpf: Reject fragmented frames in devmap
CVE-2026-64459 9.8 CRITICAL tcp: restore RCU grace period in tcp_ao_destroy_sock
CVE-2026-64303 9.8 CRITICAL spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
CVE-2026-64439 9.8 CRITICAL crypto: krb5 - filter out async aead implementations at alloc
CVE-2026-64410 9.8 CRITICAL netfilter: flowtable: IPIP tunnel hardware offload is not yet support
CVE-2026-64399 9.8 CRITICAL ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
CVE-2026-64397 9.8 CRITICAL ksmbd: serialize QUERY_DIRECTORY requests per file
CVE-2026-64391 9.8 CRITICAL ksmbd: use opener credentials for ADS I/O
CVE-2026-64387 9.8 CRITICAL smb: client: fix query directory replay double-free
CVE-2026-64386 9.8 CRITICAL smb: client: fix query_info() replay double-free
CVE-2026-64385 9.8 CRITICAL smb: client: fix double-free in SMB2_ioctl() replay
CVE-2026-64383 9.8 CRITICAL smb: client: fix double-free in SMB2_flush() replay
CVE-2026-64384 9.8 CRITICAL smb: client: fix change notify replay double-free
CVE-2026-64268 9.8 CRITICAL RDMA/siw: bound Read Response placement to the RREAD length
CVE-2026-64523 9.8 CRITICAL net/handshake: Take a long-lived file reference at submit
CVE-2026-64269 9.1 CRITICAL RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
CVE-2026-64320 9.1 CRITICAL nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
CVE-2026-64257 9.1 CRITICAL smb: client: reject overlapping data areas in SMB2 responses
CVE-2026-64393 9.1 CRITICAL ksmbd: run set info with opener credentials
CVE-2026-64392 9.1 CRITICAL ksmbd: use opener credentials for delete-on-close

Showing top 20 of 274 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64479

No comments yet

Leave a comment