CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CVE-2026-64479

highCVSS 7.1covered by 2 sourcesfirst seen 2026-07-14
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() snd_seq_event_dup() copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell->ump.raw.extra word that the memcpy() did not cover. The guard deciding whether to clear it compares the copied size against sizeof(cell->event): memcpy(&cell->ump, event, size); if (size < sizeof(cell->event)) cell->ump.raw.extra = 0; For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) == sizeof(cell->event), so the condition is false and the extra word keeps stale data. The cell pool is allocated with kvmalloc() (not zeroed) and cells are reused via a free list, so that word holds uninitialised heap or leftover event data. When such a cell is delivered to a UMP client (client->midi_version > 0) that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it unconverted -- snd_seq_read() reads it out as the larger struct snd_seq_ump_event and copies the stale word to user space, a 4-byte kernel heap infoleak to an unprivileged /dev/snd/seq client. Compare against sizeof(cell->ump) instead, so the trailing word is zeroed for every event shorter than the UMP cell.

CSIRTS triage

What
A heap leak vulnerability exists in the ALSA subsystem's event duplication function.
Who is affected
Deployments of the Linux kernel with ALSA support.
Urgency
Remediation is advisable to prevent potential information leaks, though no active exploits are reported.
Action
Install the latest kernel updates that resolve this issue.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-64479

Get an email if CVE-2026-64479 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Advisory coverage (2)

External references

NVD record for CVE-2026-64479

CVE.org record

Embed the live status

CVE-2026-64479 live status badge — this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-64479 status](https://www.csirts.com/badge/CVE-2026-64479)](https://www.csirts.com/cve/CVE-2026-64479)