{"id":"CVE-2026-90220","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Don't leak the extension cell pointer in the bounce payload\n\nThe bounce_error_event() embeds the failed event in the bounce payload\nby pointing data.ext.ptr …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Don't leak the extension cell pointer in the bounce payload\n\nThe bounce_error_event() embeds the failed event in the bounce payload\nby pointing data.ext.ptr …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 93d260ce43a81df579c98bee92b91316df9c1c57 < 42c3f856d13a91a0d4c302a0c6854813621136db","Linux >= dae23c545eb5a2be3b27a82fd0f611894fb8ab69 < b1e8d40663997aacaa198f37ce6893e07aaba77a","Linux >= efc86691e4d8083d9e380ea95042c2cf679f65fd < 6e6e471eef1d5d8cb056c7d364023fe048249204","Linux >= efc86691e4d8083d9e380ea95042c2cf679f65fd < 59e1592d3c270ff4642d5d6dc55c545306eb0693","Linux 0527a56cb327021cb73167cfddf0e49efa043500","Linux >= 6.12.97 < 6.12.110","Linux >= 6.18.40 < 6.18.52","Linux >= 7.1.5 < 7.2","Linux 7.2"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:17:17.440","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90220","references":[{"url":"https://git.kernel.org/stable/c/42c3f856d13a91a0d4c302a0c6854813621136db","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59e1592d3c270ff4642d5d6dc55c545306eb0693","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e6e471eef1d5d8cb056c7d364023fe048249204","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1e8d40663997aacaa198f37ce6893e07aaba77a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-17T16:21:47.855Z","epss":0.002,"epssPercentile":0.10119,"slug":"CVE-2026-90220","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Don't leak the extension cell pointer in the bounce payload\n\nThe bounce_error_event() embeds the failed event in the bounce payload\nby pointing data.ext.ptr at it.  When that event is a queued\nvariable-length event, its own data.ext.ptr holds the address of its\nfirst extension cell, put there by snd_seq_event_dup().  The payload\ngoes out verbatim through snd_seq_expand_var_event(), so the address\nreaches userspace.\n\nThat is the same address commit 705dd6dcbc0e (\"ALSA: seq: Clear\nvariable event pointer on read\") removed from the event header.  The\nread path still clears it there, just above the call that expands the\npayload.\n\nEmbed a sanitised copy instead, treated exactly as snd_seq_read()\ntreats the header.  A stack copy is enough because delivery is\nsynchronous and snd_seq_event_dup() copies before returning.\n\nAn unprivileged client reaches this by setting SNDRV_SEQ_FILTER_BOUNCE,\nqueueing a variable-length event to a port that does not exist and\nreading the bounce back.  Eight bytes on 64-bit, from its own pool.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}