CVE-2026-64029

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: Serialize UMP output teardown with event_input

seq_ump_process_event() borrows client->out_rfile.output without

synchronizing with the first-open and last-close transition in

seq_ump_client_open() and seq_ump_client_close().

The last output unuse can therefore drop opened[STR_OUT] to zero and

release the rawmidi file while an in-flight event_input callback is still

inside snd_rawmidi_kernel_write(). That leaves the rawmidi substream

runtime exposed to teardown before the write path has taken its own

buffer reference.

Add a per-client rwlock for the event_input-visible output file. Publish

a newly opened output file under the write side, and hold the read side

from the output lookup through snd_rawmidi_kernel_write(). The last

output close copies and clears the visible output file under the write

side, then drops the lock and releases the saved rawmidi file. Use

IRQ-safe rwlock guards because event_input

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References