Heap Information Leak in Linux Kernel ALSA's snd_seq_event_dup() Function

CVE-2026-64479

What is CVE-2026-64479?

The snd_seq_event_dup() function in the Advanced Linux Sound Architecture (ALSA) of the Linux kernel has an uninitialized heap leak issue. This vulnerability arises when data is copied into a pool cell during the processing of MIDI events. If the event size is smaller than the expected cell size in certain configurations, leftover data remains in the memory, leading to potential information disclosure when delivered to unprivileged clients. This leak can expose sensitive heap data to clients, posing a significant risk of unintended information exposure.

References