CVE-2026-64029
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: Serialize UMP output teardown with event_input
seq_ump_process_event() borrows client->out_rfile.output without
synchronizing with the first-open and last-close transition in
seq_ump_client_open() and seq_ump_client_close().
The last output unuse can therefore drop opened[STR_OUT] to zero and
release the rawmidi file while an in-flight event_input callback is still
inside snd_rawmidi_kernel_write(). That leaves the rawmidi substream
runtime exposed to teardown before the write path has taken its own
buffer reference.
Add a per-client rwlock for the event_input-visible output file. Publish
a newly opened output file under the write side, and hold the read side
from the output lookup through snd_rawmidi_kernel_write(). The last
output close copies and clears the visible output file under the write
side, then drops the lock and releases the saved rawmidi file. Use
IRQ-safe rwlock guards because event_input can also be reached from
atomic sequencer delivery.
The buggy scenario involves two paths, with each column showing the
order within that path:
path A label: event_input path path B label: last unuse path
1. seq_ump_process_event() reads 1. seq_ump_client_close()
client->out_rfile.output. drops opened[STR_OUT] to zero.
2. snd_rawmidi_kernel_write1() 2. snd_rawmidi_kernel_release()
has not yet pinned runtime. closes the output file.
3. The writer continues using 3. close_substream() frees
the borrowed substream. substream->runtime.
This keeps the output substream and runtime alive for the full
event_input write while keeping rawmidi release outside the rwlock.
KASAN reproduced this as a slab-use-after-free in
snd_rawmidi_kernel_write1(), with allocation through
seq_ump_use()/snd_seq_port_connect() and free through
seq_ump_unuse()/snd_seq_port_disconnect().
Validation reproduced this kernel report:
KASAN
CSIRTS triage
- What
- Multiple kernel vulnerabilities across architectures and driver subsystems including AMD processor microarchitectural flaws and cache isolation issues.
- Who is affected
- NVIDIA BaseOS systems running affected Linux kernel versions.
- Urgency
- Moderate; privilege escalation and DoS vectors present, primarily requiring local access.
- Action
- Apply USN-8664-1 kernel security update for NVIDIA BaseOS.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-64029
Get an email if CVE-2026-64029 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
Advisory coverage (8)
- unknownUSN-8729-1: Linux kernel vulnerabilitiesubuntu · 2026-09-07
- unknownexploitedUSN-8728-1: Linux kernel (GCP) vulnerabilitiesubuntu · 2026-09-07
- unknownUSN-8664-1: Linux kernel (NVIDIA BaseOS) vulnerabilitiesubuntu · 2026-08-20
- unknownUSN-8663-1: Linux kernel (NVIDIA) vulnerabilitiesubuntu · 2026-08-20
- highUSN-8618-1: Linux kernel vulnerabilitiesubuntu · 2026-07-28
- highUSN-8603-1: Linux kernel (Azure) vulnerabilitiesubuntu · 2026-07-24
- highUSN-8593-1: Linux kernel vulnerabilitiesubuntu · 2026-07-23
- highCVE-2026-64029: In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP o…nvd · 2026-07-19
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-64029)