CVE-2026-90220ALSA: seq: Don't leak the extension cell pointer in the bounce payload
- —Not scoredno CVSS score yet
- 0.20%Exploitation in 30 daysEPSS · top 90% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounce_error_event() embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own data.ext.ptr holds the address of its first extension cell, put there by snd_seq_event_dup(). The payload goes out verbatim through snd_seq_expand_var_event(), so the address reaches userspace. That is the same address commit 705dd6dcbc0e ("ALSA: seq: Clear variable event pointer on read") removed from the event header. The read path still clears it there, just above the call that expands the payload. Embed a sanitised copy instead, treated exactly as snd_seq_read() treats the header. A stack copy is enough because delivery is synchronous and snd_seq_event_dup() copies before returning. An unprivileged client reaches this by setting SNDRV_SEQ_FILTER_BOUNCE, queueing a variable-length event to a port that does not exist and reading the bounce back. Eight bytes on 64-bit, from its own pool.
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 43 days later
· 43 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.20% · top 90% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 05e2358fec8812c37516ccea63bc4b9956d864ba – < c92b2e6e418a3885758438dddcead6e954a9e095
- affected 93d260ce43a81df579c98bee92b91316df9c1c57 – < 42c3f856d13a91a0d4c302a0c6854813621136db
- affected dae23c545eb5a2be3b27a82fd0f611894fb8ab69 – < b1e8d40663997aacaa198f37ce6893e07aaba77a
- affected efc86691e4d8083d9e380ea95042c2cf679f65fd – < 6e6e471eef1d5d8cb056c7d364023fe048249204
- affected efc86691e4d8083d9e380ea95042c2cf679f65fd – < 59e1592d3c270ff4642d5d6dc55c545306eb0693
- affected eae296065ede41a24040e6a7c909ec970f78b4eb
- affected 0527a56cb327021cb73167cfddf0e49efa043500
- affected 6.12.97 – < 6.12.110
- affected 6.18.40 – < 6.18.52
- affected 6.6.160 – < 6.7
- affected 7.1.5 – < 7.2
- affected 7.2
- unaffected < 7.2
- unaffected 6.12.110 – ≤ 6.12.*
- unaffected 6.18.52 – ≤ 6.18.*
- unaffected 7.2.6 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References5
- https://git.kernel.org/stable/c/c92b2e6e418a3885758438dddcead6e954a9e095 (opens in a new tab)
- https://git.kernel.org/stable/c/42c3f856d13a91a0d4c302a0c6854813621136db (opens in a new tab)
- https://git.kernel.org/stable/c/b1e8d40663997aacaa198f37ce6893e07aaba77a (opens in a new tab)
- https://git.kernel.org/stable/c/6e6e471eef1d5d8cb056c7d364023fe048249204 (opens in a new tab)
- https://git.kernel.org/stable/c/59e1592d3c270ff4642d5d6dc55c545306eb0693 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-81813 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-90220)Record last updated .