Riskcovery

CVE-2026-98086

ALSA: ump: do not touch legacy_rmidi before it exists

State
Published
Severity
Not scored
Published
Sep 25, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ump: do not touch legacy_rmidi before it exists

snd_ump_parse_endpoint() sets ump->parsed on every exit, including error, before the caller attaches the legacy rawmidi device. ump_handle_ep_name_msg() then treats parsed as "legacy_rmidi is live" and calls ump_legacy_set_rawmidi_name(), which snprintf()s into ump->legacy_rmidi->name. If a UMP packet arrives in that window (IRQ path from snd_ump_receive), legacy_rmidi is still NULL (KASAN null-ptr-deref in snprintf).

Guard the legacy helpers. parsed only means endpoint info was parsed, not that legacy_rmidi exists.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 37e0e14128e0685267dc5c037bf655421a6ce2ea to before d6f9af093dc91dac8848a01e417b8109c651c0b2Affected
  • 37e0e14128e0685267dc5c037bf655421a6ce2ea to before 1c8e01792adf91879322f1ad752f1814de8b7e7dAffected
  • 37e0e14128e0685267dc5c037bf655421a6ce2ea to before 228075f31b141395233218712242913125ace4e0Affected
  • 37e0e14128e0685267dc5c037bf655421a6ce2ea to before a4cef20cd473e0640fefd38094d4baac0ec76ae3Affected
  • 37e0e14128e0685267dc5c037bf655421a6ce2ea to before adeee7187694719890aaffdc14b7e89cfd736f1dAffected
LinuxLinux
  • 6.5Affected
  • before 6.5Not affected
  • 6.6.158 through 6.6.*Not affected
  • 6.12.111 through 6.12.*Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.2.7 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.