CVE-2026-64479

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()<br /> <br /> snd_seq_event_dup() copies an incoming event into a pool cell and, in<br /> the UMP-enabled build, clears the trailing cell-&gt;ump.raw.extra word that<br /> the memcpy() did not cover. The guard deciding whether to clear it<br /> compares the copied size against sizeof(cell-&gt;event):<br /> <br /> memcpy(&amp;cell-&gt;ump, event, size);<br /> if (size event))<br /> cell-&gt;ump.raw.extra = 0;<br /> <br /> For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) ==<br /> sizeof(cell-&gt;event), so the condition is false and the extra word keeps<br /> stale data. The cell pool is allocated with kvmalloc() (not zeroed) and<br /> cells are reused via a free list, so that word holds uninitialised heap<br /> or leftover event data.<br /> <br /> When such a cell is delivered to a UMP client (client-&gt;midi_version &gt; 0)<br /> that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it<br /> unconverted -- snd_seq_read() reads it out as the larger struct<br /> snd_seq_ump_event and copies the stale word to user space, a 4-byte<br /> kernel heap infoleak to an unprivileged /dev/snd/seq client.<br /> <br /> Compare against sizeof(cell-&gt;ump) instead, so the trailing word is zeroed<br /> for every event shorter than the UMP cell.