CVE-2026-74339

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ALSA sequencer where the snd seq read() function copies a queued variable-length event header to userspace before the payload is expanded. While the system removes specific bits from data.ext.len before copying, it fails to clear the data.ext.ptr variable, which points to the first extension cell. This allows a userspace sequencer client to write a direct variable event to itself and subsequently retrieve a kernel address from the returned header.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.