CVE-2026-74278

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: Fix kernel heap address leak in bounce_error_event()

The comment above bounce_error_event() documents that user clients

should receive SNDRV_SEQ_EVENT_BOUNCE with the original event embedded

as variable-length data, while kernel clients should receive

SNDRV_SEQ_EVENT_KERNEL_ERROR with a quoted kernel pointer.

However, the implementation unconditionally uses

SNDRV_SEQ_EVENT_KERNEL_ERROR with data.quote.event set to the raw

struct snd_seq_event pointer for all clients. When a bounce error

event is delivered to a USER_CLIENT via snd_seq_read(), the kernel

heap address in data.quote.event is exposed to userspace through

copy_to_user() in the fixed-length branch.

This is a distinct leak path from the one addressed by commit

705dd6dcbc0e ("ALSA: seq: Clear variable event pointer on read"),

which sanitizes data.ext.ptr in the variable-length branch of

snd_seq_read(). The bounce_error_event() leak uses fixed-l

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References