CVE-2026-90220

A flaw was found in the ALSA (Advanced Linux Sound Architecture) sequencer component of the Linux kernel. An unprivileged local attacker can exploit this vulnerability by sending a specially crafted variable-length event to a non-existent port and then reading the bounced error event. This can lead to the disclosure of sensitive kernel memory addresses, specifically an extension cell pointer, which could aid in bypassing security protections.

A moderate-severity information disclosure flaw was found in the ALSA sequencer subsystem of the Linux kernel as shipped in Red Hat Enterprise Linux 9 (rhel-9.9, rhel-9.10), Red Hat Enterprise Linux 10 (rhel-10.3, rhel-10.4), and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm components). An unprivileged local attacker with access to the ALSA sequencer interface can set the SNDRV_SEQ_FILTER_BOUNCE event filter, queue a variable-length event to a non-existent sequencer port, and read the returned bounce error event. Because bounce_error_event() embeds the failed event in the bounce payload without clearing its variable-length extension pointer, the kernel heap address of the event's extension cell (eight bytes on 64-bit systems) is disclosed to userspace. The leaked address does not by itself permit privilege escalation, code execution, or denial of service, but it weakens kernel address space randomization and could assist exploitation of a separate memory-corruption flaw. Other Red Hat Enterprise Linux streams, including RHEL 6, RHEL 7, RHEL 8, the earlier RHEL 9 and RHEL 10 minor streams, and the OpenShift Container Platform RHEL CoreOS kernels, are not affected because the vulnerable code is not present in those builds. Fixes for the affected streams are deferred to future planned updates; the residual risk is limited to disclosure of a single kernel heap address to an already-local unprivileged user, consistent with the moderate severity rating.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.