---
id: CVE-2026-90220
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: seq: Don't leak the extension cell pointer in the bounce payload

  The bounce_error_event() embeds the failed event in the bounce payload
  by pointing data.ext.ptr …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: seq: Don't leak the extension cell pointer in the bounce payload

  The bounce_error_event() embeds the failed event in the bounce payload
  by pointing data.ext.ptr …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 93d260ce43a81df579c98bee92b91316df9c1c57 <
    42c3f856d13a91a0d4c302a0c6854813621136db
  - >-
    Linux >= dae23c545eb5a2be3b27a82fd0f611894fb8ab69 <
    b1e8d40663997aacaa198f37ce6893e07aaba77a
  - >-
    Linux >= efc86691e4d8083d9e380ea95042c2cf679f65fd <
    6e6e471eef1d5d8cb056c7d364023fe048249204
  - >-
    Linux >= efc86691e4d8083d9e380ea95042c2cf679f65fd <
    59e1592d3c270ff4642d5d6dc55c545306eb0693
  - Linux 0527a56cb327021cb73167cfddf0e49efa043500
  - Linux >= 6.12.97 < 6.12.110
  - Linux >= 6.18.40 < 6.18.52
  - Linux >= 7.1.5 < 7.2
  - Linux 7.2
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:17.440'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90220'
references:
  - url: 'https://git.kernel.org/stable/c/42c3f856d13a91a0d4c302a0c6854813621136db'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/59e1592d3c270ff4642d5d6dc55c545306eb0693'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6e6e471eef1d5d8cb056c7d364023fe048249204'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b1e8d40663997aacaa198f37ce6893e07aaba77a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.855Z'
epss: 0.002
epssPercentile: 0.10135
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: Don't leak the extension cell pointer in the bounce payload

The bounce_error_event() embeds the failed event in the bounce payload
by pointing data.ext.ptr at it.  When that event is a queued
variable-length event, its own data.ext.ptr holds the address of its
first extension cell, put there by snd_seq_event_dup().  The payload
goes out verbatim through snd_seq_expand_var_event(), so the address
reaches userspace.

That is the same address commit 705dd6dcbc0e ("ALSA: seq: Clear
variable event pointer on read") removed from the event header.  The
read path still clears it there, just above the call that expands the
payload.

Embed a sanitised copy instead, treated exactly as snd_seq_read()
treats the header.  A stack copy is enough because delivery is
synchronous and snd_seq_event_dup() copies before returning.

An unprivileged client reaches this by setting SNDRV_SEQ_FILTER_BOUNCE,
queueing a variable-length event to a port that does not exist and
reading the bounce back.  Eight bytes on 64-bit, from its own pool.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.