{"id":"CVE-2026-90220","summary":"ALSA: seq: Don't leak the extension cell pointer in the bounce payload","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Don't leak the extension cell pointer in the bounce payload\n\nThe bounce_error_event() embeds the failed event in the bounce payload\nby pointing data.ext.ptr at it.  When that event is a queued\nvariable-length event, its own data.ext.ptr holds the address of its\nfirst extension cell, put there by snd_seq_event_dup().  The payload\ngoes out verbatim through snd_seq_expand_var_event(), so the address\nreaches userspace.\n\nThat is the same address commit 705dd6dcbc0e (\"ALSA: seq: Clear\nvariable event pointer on read\") removed from the event header.  The\nread path still clears it there, just above the call that expands the\npayload.\n\nEmbed a sanitised copy instead, treated exactly as snd_seq_read()\ntreats the header.  A stack copy is enough because delivery is\nsynchronous and snd_seq_event_dup() copies before returning.\n\nAn unprivileged client reaches this by setting SNDRV_SEQ_FILTER_BOUNCE,\nqueueing a variable-length event to a port that does not exist and\nreading the bounce back.  Eight bytes on 64-bit, from its own pool.","modified":"2026-11-13T04:07:11.452608869Z","published":"2026-09-17T16:07:31.423Z","related":["SUSE-SU-2026:24550-1","SUSE-SU-2026:24619-1","SUSE-SU-2026:24643-1","SUSE-SU-2026:24648-1","SUSE-SU-2026:24651-1","SUSE-SU-2026:24662-1","SUSE-SU-2026:5091-1","SUSE-SU-2026:5121-1","openSUSE-SU-2026:11880-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90220.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/42c3f856d13a91a0d4c302a0c6854813621136db"},{"type":"WEB","url":"https://git.kernel.org/stable/c/59e1592d3c270ff4642d5d6dc55c545306eb0693"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6e6e471eef1d5d8cb056c7d364023fe048249204"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b1e8d40663997aacaa198f37ce6893e07aaba77a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c92b2e6e418a3885758438dddcead6e954a9e095"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90220.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90220"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"05e2358fec8812c37516ccea63bc4b9956d864ba"},{"fixed":"c92b2e6e418a3885758438dddcead6e954a9e095"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"93d260ce43a81df579c98bee92b91316df9c1c57"},{"fixed":"42c3f856d13a91a0d4c302a0c6854813621136db"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"dae23c545eb5a2be3b27a82fd0f611894fb8ab69"},{"fixed":"b1e8d40663997aacaa198f37ce6893e07aaba77a"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"efc86691e4d8083d9e380ea95042c2cf679f65fd"},{"fixed":"6e6e471eef1d5d8cb056c7d364023fe048249204"},{"fixed":"59e1592d3c270ff4642d5d6dc55c545306eb0693"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"eae296065ede41a24040e6a7c909ec970f78b4eb"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0527a56cb327021cb73167cfddf0e49efa043500"}]}],"versions":["v6.12.109","v6.12.108","v6.12.107","v6.12.106","v6.12.105","v6.12.104","v6.12.103","v6.12.102","v6.12.101","v6.12.100","v6.12.99","v6.12.98","v6.12.97","v6.18.51","v6.18.50","v6.18.49","v6.18.48","v6.18.47","v6.18.46","v6.18.45","v6.18.44","v6.18.43","v6.18.42","v6.18.41","v6.18.40","v6.6.162","v6.6.161","v6.6.160","v7.1.13","v7.1.12","v7.1.11","v7.1.10","v7.1.9","v7.1.8","v7.1.7","v7.1.6","v7.1.5"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-90220.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.160"},{"fixed":"6.7"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.12.97"},{"fixed":"6.12.110"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.18.40"},{"fixed":"6.18.52"}]},{"type":"ECOSYSTEM","events":[{"introduced":"7.1.5"},{"fixed":"7.2"}]},{"type":"ECOSYSTEM","events":[{"introduced":"7.2.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-90220.json"}}],"schema_version":"1.9.2"}