{"apiVersion":"1.0","identifier":"CVE-2026-74339","description":"In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read snd_seq_read() copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRV_SEQ_EXT_CHAINED internally, and data.ext.ptr points at the first extension cell. The read side strips SNDRV_SEQ_EXT_* bits from data.ext.len before the copy, but it leaves data.ext.ptr untouched. A userspace sequencer client can therefore write a direct variable event to itself and read back the extension-cell kernel address from the returned header. Clear the temporary header pointer before copy_to_user(). The original queued event remains unchanged and is still passed to snd_seq_expand_var_event(), so payload expansion keeps using the internal chain.","publishedAt":"2026-08-15T06:22:34","lastModifiedAt":"2026-08-17T06:19:28","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74339","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00173,"riskScore":0,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74339","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74339","en":"https://www.redsauce.net/en/cves/CVE-2026-74339","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74339","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74339","de":"https://www.redsauce.net/de/cves/CVE-2026-74339","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74339","el":"https://www.redsauce.net/el/cves/CVE-2026-74339"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74339"}}