CVE-2026-74278

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) sequencer. A local attacker could exploit a vulnerability in the bounce_error_event() function, which improperly handles bounce error events for user clients. This flaw allows for the disclosure of kernel heap memory addresses to userspace, potentially providing sensitive information that could aid in further attacks.

This vulnerability is rated as having a Moderate impact because it requires local access and only results in an information leak rather than code execution or denial of service. On standard Red Hat Enterprise Linux server deployments, sound sequencer interfaces are not typically accessible or required by unprivileged users, limiting real-world exposure. An authenticated local user could query the ALSA sequencer device to retrieve internal kernel heap addresses, potentially facilitating KASLR bypasses when combined with other flaws.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.