CVE-2026-74387

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: midi: Serialize output teardown with event_input

event_process_midi() borrows msynth->output_rfile.output and then

passes the substream to dump_midi() and snd_rawmidi_kernel_write()

without synchronizing with the output open/close transition.

midisynth_use() also publishes output_rfile before

snd_rawmidi_output_params() has finished.

The last midisynth_unuse() can therefore release the same rawmidi file

and free substream->runtime before snd_rawmidi_kernel_write1() takes

its runtime buffer reference. That leaves the event_input path using a

stale substream or runtime and can end in a NULL-deref or use-after-free.

Fix this with two pieces of synchronization. Keep a short IRQ-safe

spinlock only for publishing or clearing output_rfile and for pairing

the output snapshot with an snd_use_lock_t reference. Once

event_process_midi() has taken that in-flight reference, it drops the

spinlock before calling snd_se

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References