CVE-2026-64479

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) sequencer. This vulnerability allows an unprivileged local user to trigger a heap information leak in the snd_seq_event_dup() function. By reading from /dev/snd/seq, an attacker can obtain 4 bytes of uninitialized kernel heap memory. This could lead to the disclosure of sensitive kernel data.

This vulnerability is rated with a Moderate impact for Red Hat Enterprise Linux because exploitation is restricted to authenticated local users and is limited to leaking small fragments of uninitialized heap memory. The issue requires local access to interact with the ALSA sequencer character device and does not permit code execution, privilege escalation, or direct system disruption. Because it only allows read access to minor chunks of residual kernel memory rather than enabling broader system compromise, it does not warrant an Important severity rating.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.