CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error
In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: oss: Fix setup list UAF on proc write error
sndpcmossprocwrite() links a newly allocated setup entry into the OSS setup list before duplicating the task name. If the task-name allocation fails, the error path frees the already linked entry and leaves setuplist pointing at freed memory.
A later OSS device open can then walk the stale list entry in sndpcmosslookforsetup() and dereference freed memory.
Allocate the task name and initialize the setup entry before publishing the entry on setuplist. Also fetch the initial proc read iterator only after taking setupmutex, so all setuplist traversal follows the same list lifetime rules.
Affected Software
Remediation
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What sequence triggers the use-after-free?
A proc write through the OSS PCM path must encounter a task-name allocation failure after a setup entry has been linked into the OSS setup list. A subsequent OSS device open can traverse that stale list entry and dereference freed memory.
What should teams do if they are affected?
Apply the available Linux kernel patch. The supplied fixes ensure setup entries are fully initialized before being added to the setup list and synchronize list traversal with the setup mutex.