CVE-2026-74388

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Open Sound System (OSS) sequencer. A local attacker could exploit a Use-After-Free (UAF) vulnerability by concurrently closing a sequencer port while an event containing System Exclusive (SysEx) data is pending dispatch. This could lead to a denial of service or potentially arbitrary code execution.

ALSA OSS sequencer can hit a use after free when MIDI SysEx bytes are converted into a pending sequencer event and the sequencer port is closed concurrently before the event is dispatched. The event may keep data ext ptr pointing to storage that is released by snd_seq_oss_midi_check_exit_port, and later snd_seq_event_dup copies from this stale pointer. For the CVSS the PR:L is used because a local user or local process needs access to the OSS sequencer device and must race event submission with port close. The issue is not network reachable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.