CVE-2026-74387

Status: UPDATED  |  Advisory ID: CVE-2026-74387

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: midi: Serialize output teardown with event_input

event_process_midi() borrows msynth->output_rfile.output and then

passes the substream to dump_midi() and snd_rawmidi_kernel_write()

without synchronizing with the output open/close transition.

midisynth_use() also publishes output_rfile before

snd_rawmidi_output_params() has finished.

The last midisynth_unuse() can therefore release the same rawmidi file

and free substream->runtime before snd_rawmidi_kernel_write1() takes

its runtime buffer reference. That leaves the event_input path using a

stale substream or runtime and can end in a NULL-deref or use-after-free.

Fix this with two pieces of synchronization. Keep a short IRQ-safe

spinlock only for publishing or clearing output_rfile and for pairing

the output snapshot with an snd_use_lock_t reference. Once

event_process_midi() has taken that in-flight reference, it drops the

spinlock before calling snd_seq_dump_var_event(), dump_midi(), or

snd_rawmidi_kernel_write(). midisynth_unuse() now detaches the visible

rawmidi file under the same spinlock, waits for the in-flight writers

to drain, and only then drains and releases the saved file.

midisynth_use() likewise opens into a local snd_rawmidi_file and

publishes it only after snd_rawmidi_output_params() succeeds.

The buggy scenario involves two paths, with each column showing the

order within that path:

event_input path: last unuse path:

1. event_process_midi() snapshots 1. midisynth_unuse() starts

output_rfile.output. tearing down output_rfile.

2. dump_midi() reaches 2. snd_rawmidi_kernel_release()

snd_rawmidi_kernel_write() closes the output file.

before runtime is pinned. 3. close_substream() frees

3. The callback keeps using substream->runtime.

the borrowed substream.

Validation reproduced this kernel report:

KASAN null-ptr-deref in snd_rawmidi_kernel_write1+0x56/0x360

RIP: 0033:0x7fde7dd0837f

RIP: 0010:snd_rawmidi_kernel_write1+0x56/0x360 (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References