In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: oss: Fix setup list UAF on proc write error
snd_pcm_oss_proc_write() links a newly allocated setup entry into the
OSS setup list before duplicating the task name. If the task-name
allocation fails, the error path frees the already linked entry and
leaves setup_list pointing at freed memory.
A later OSS device open can then walk the stale list entry in
snd_pcm_oss_look_for_setup() and dereference freed memory.
Allocate the task name and initialize the setup entry before publishing
the entry on setup_list. Also fetch the initial proc read iterator only
after taking setup_mutex, so all setup_list traversal follows the same
list lifetime rules.
References
Configurations
Configuration 1 (hide)
|
History
21 Oct 2026, 13:19
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Oct 2026, 19:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/4cc54bdd54b337e77115be5b55577d1c58608eae - Patch | |
| References | () https://git.kernel.org/stable/c/8be4efd0dc0093eb7a02ad1aac936bca2a1f04ce - Patch | |
| References | () https://git.kernel.org/stable/c/be387230dc22d870afd0e5d35912b07c2bc323bd - Patch | |
| References | () https://git.kernel.org/stable/c/e13922bb97b4e6f94f8ac02d034f2d4bd65eeb3c - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
|
| First Time |
Linux
Linux linux Kernel |
|
| CWE | CWE-416 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
Information
Published : 2026-07-19 16:17
Updated : 2026-10-21 13:19
NVD link : CVE-2026-64001
Mitre link : CVE-2026-64001
CVE.ORG link : CVE-2026-64001
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free