REDHAT-BUG-2536701: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: midi: Serialize input teardown with eventinput
sndmidiinputevent() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in sndrawmidiinputtrigger():
sndrawmidiinputtrigger(up=0) sndmidiinputevent() -> sndrawmidikernelread() -> sndrawmidiinputtrigger(up=1) -> cancelworksync()
which ends with the underlying device being active unexpectedly.
When this is called from closesubstream(), further input can re-trigger the input event leaving it running after rawmidireleasepriv() has set rfile->rmidi to NULL which leads to:
Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b0 Call trace: sndmidiinputevent+0x3c/0x134 [sndseqmidi] (P) sndrawmidiinputeventwork+0x1c/0x2c processonework+0x150/0x3a4 workerthread+0x190/0x318
Apply a similar approach to commit ef7607ab1c8ad ("ALSA: seq: midi: Serialize output teardown with eventinput") which fixed the same issue in the output direction, but updated to use RCU following Takashi Iwai's proposed follow-on patch [1].
With this change in place, midisynthunsubscribe() clears the input file so sndmidiinputevent() will not re-trigger the stream and will be quiesced by the cancelworksync() in sndrawmidiinputtrigger().
[1] https://lore.kernel.org/linux-sound/20260813144224.753399-1-tiwai@suse.de/
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
The race requires MIDI input event handling to run while a rawmidi substream is being closed. Further input can then re-trigger event processing after release state has cleared the rawmidi pointer.
What is the likely impact if the race is triggered?
The described outcome is a kernel NULL pointer dereference in snd_midi_input_event, producing an unable-to-handle-kernel-NULL-pointer fault. This can cause a kernel crash or loss of availability.
Which systems are most relevant to triage?
Systems using the Linux kernel's ALSA sequencer MIDI functionality and rawmidi input paths are relevant. The supplied information does not identify affected kernel versions or whether this functionality is enabled by default.
Is there a mitigation described when an update cannot be applied immediately?
No specific workaround is provided. Reducing or avoiding use of ALSA sequencer MIDI rawmidi input functionality would avoid the race path described, but the data does not provide a validated mitigation procedure.