CVE-2026-74387: ALSA: seq: midi: Serialize output teardown with event_input
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: midi: Serialize output teardown with eventinput
eventprocessmidi() borrows msynth->outputrfile.output and then passes the substream to dumpmidi() and sndrawmidikernelwrite() without synchronizing with the output open/close transition. midisynthuse() also publishes outputrfile before sndrawmidioutputparams() has finished.
The last midisynthunuse() can therefore release the same rawmidi file and free substream->runtime before sndrawmidikernelwrite1() takes its runtime buffer reference. That leaves the eventinput path using a stale substream or runtime and can end in a NULL-deref or use-after-free.
Fix this with two pieces of synchronization. Keep a short IRQ-safe spinlock only for publishing or clearing outputrfile and for pairing the output snapshot with an snduselockt reference. Once eventprocessmidi() has taken that in-flight reference, it drops the spinlock before calling sndseqdumpvarevent(), dumpmidi(), or sndrawmidikernelwrite(). midisynthunuse() now detaches the visible rawmidi file under the same spinlock, waits for the in-flight writers to drain, and only then drains and releases the saved file. midisynthuse() likewise opens into a local sndrawmidifile and publishes it only after sndrawmidioutputparams() succeeds.
The buggy scenario involves two paths, with each column showing the order within that path:
eventinput path: last unuse path: 1. eventprocessmidi() snapshots 1. midisynthunuse() starts outputrfile.output. tearing down outputrfile. 2. dumpmidi() reaches 2. sndrawmidikernelrelease() sndrawmidikernelwrite() closes the output file. before runtime is pinned. 3. closesubstream() frees 3. The callback keeps using substream->runtime. the borrowed substream.
Validation reproduced this kernel report: KASAN null-ptr-deref in sndrawmidikernelwrite1+0x56/0x360 RIP: 0033:0x7fde7dd0837f RIP: 0010:sndrawmidikernelwrite1+0x56/0x360
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-147.147 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1067.70 - Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1069.76 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1066.74 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1052.56 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1067.68 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-147.147.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1064.67 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1033.38 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1062.63 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1067.70+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-147.147+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79+fips1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
Synchronize ALSA sequencer MIDI output teardown: protect publishing and clearing output_rfile.output with a short IRQ-safe spinlock while pairing each output snapshot with an snd_use_lock_t in-flight reference; release the spinlock before calling snd_seq_dump_var_event(), dump_midi(), or snd_rawmidi_kernel_write(). In midisynth_use(), publish the locally opened rawmidi file only after snd_rawmidi_output_params() succeeds. In midisynth_unuse(), detach output_rfile.output under the same spinlock, wait for in-flight writers to drain, then drain and release the saved file.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74387?
CVE-2026-74387 has a risk score of 40, indicating a medium level of severity.
How do I fix CVE-2026-74387?
To mitigate CVE-2026-74387, ensure that your system is updated with the latest patch from the Linux kernel.
What systems are affected by CVE-2026-74387?
CVE-2026-74387 affects systems running vulnerable versions of the Linux kernel that utilize ALSA sequencer with MIDI support.
What type of vulnerability is CVE-2026-74387?
CVE-2026-74387 is categorized as a Use After Free vulnerability.
What are the potential impacts of CVE-2026-74387?
Exploitation of CVE-2026-74387 may lead to memory corruption and could allow an attacker to execute arbitrary code.