CVE-2026-98086: ALSA: ump: do not touch legacy_rmidi before it exists
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ump: do not touch legacyrmidi before it exists
sndumpparseendpoint() sets ump->parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg() then treats parsed as "legacyrmidi is live" and calls umplegacysetrawmidiname(), which snprintf()s into ump->legacyrmidi->name. If a UMP packet arrives in that window (IRQ path from sndumpreceive), legacyrmidi is still NULL (KASAN null-ptr-deref in snprintf).
Guard the legacy helpers. parsed only means endpoint info was parsed, not that legacyrmidi exists.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Guard the legacy helpers so they do not access legacy_rmidi until the legacy rawmidi device exists; do not treat ump->parsed as indicating that legacy_rmidi is live.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel ALSA UMP path are exposed when a UMP packet can be received during endpoint setup, before the legacy rawmidi device has been attached.
What does an attacker or triggering condition need to exploit it?
A UMP packet must arrive through the snd_ump_receive IRQ path after endpoint parsing has completed but before legacy_rmidi is created. In that window, processing an endpoint-name message can dereference a NULL legacy_rmidi pointer.
How can I tell whether the vulnerable condition occurred?
The described failure manifests as a KASAN-detected NULL-pointer dereference in snprintf(), reached through ump_legacy_set_rawmidi_name() while handling a UMP endpoint-name message.