-

CVE-2026-98086

ALSA: ump: do not touch legacy_rmidi before it exists

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ump: do not touch legacy_rmidi before it exists

snd_ump_parse_endpoint() sets ump->parsed on every exit, including
error, before the caller attaches the legacy rawmidi device.
ump_handle_ep_name_msg() then treats parsed as "legacy_rmidi is live"
and calls ump_legacy_set_rawmidi_name(), which snprintf()s into
ump->legacy_rmidi->name. If a UMP packet arrives in that window
(IRQ path from snd_ump_receive), legacy_rmidi is still NULL
(KASAN null-ptr-deref in snprintf).

Guard the legacy helpers. parsed only means endpoint info was
parsed, not that legacy_rmidi exists.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 37e0e14128e0685267dc5c037bf655421a6ce2ea
Version < d6f9af093dc91dac8848a01e417b8109c651c0b2
Status affected
Version 37e0e14128e0685267dc5c037bf655421a6ce2ea
Version < 1c8e01792adf91879322f1ad752f1814de8b7e7d
Status affected
Version 37e0e14128e0685267dc5c037bf655421a6ce2ea
Version < 228075f31b141395233218712242913125ace4e0
Status affected
Version 37e0e14128e0685267dc5c037bf655421a6ce2ea
Version < a4cef20cd473e0640fefd38094d4baac0ec76ae3
Status affected
Version 37e0e14128e0685267dc5c037bf655421a6ce2ea
Version < adeee7187694719890aaffdc14b7e89cfd736f1d
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.5
Status affected
Version 0
Version < 6.5
Status unaffected
Version <= 6.6.*
Version 6.6.158
Status unaffected
Version <= 6.12.*
Version 6.12.111
Status unaffected
Version <= 6.18.*
Version 6.18.53
Status unaffected
Version <= 7.2.*
Version 7.2.7
Status unaffected
Version <= *
Version 7.3-rc2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.088
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/1c8e01792adf91879322f1ad752f1814de8b7e7d
https://git.kernel.org/stable/c/228075f31b141395233218712242913125ace4e0
https://git.kernel.org/stable/c/a4cef20cd473e0640fefd38094d4baac0ec76ae3
https://git.kernel.org/stable/c/adeee7187694719890aaffdc14b7e89cfd736f1d
https://git.kernel.org/stable/c/d6f9af093dc91dac8848a01e417b8109c651c0b2