CVE-2026-98086
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacy_rmidi before it exists snd_ump_parse_endpoint() sets ump->parsed on every exit, including error, before the caller attaches the legacy rawmidi device. ump_handle_ep_name_msg() then treats parsed as "legacy_rmidi is live" and calls ump_legacy_set_rawmidi_name(), which snprintf()s into ump->legacy_rmidi->name. If a UMP packet arrives in that window (IRQ path from snd_ump_receive), legacy_rmidi is still NULL (KASAN null-ptr-deref in snprintf). Guard the legacy helpers. parsed only means endpoint info was parsed, not that legacy_rmidi exists.
How to fix
- Linux Linuxd6f9af093dc91dac8848a01e417b8109c651c0b2, 1c8e01792adf91879322f1ad752f1814de8b7e7d, 228075f31b141395233218712242913125ace4e0, a4cef20cd473e0640fefd38094d4baac0ec76ae3, adeee7187694719890aaffdc14b7e89cfd736f1d or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 37e0e14128e0685267dc5c037bf655421a6ce2ea ≤ v < d6f9af093dc91dac8848a01e417b8109c651c0b2, 37e0e14128e0685267dc5c037bf655421a6ce2ea ≤ v < 1c8e01792adf91879322f1ad752f1814de8b7e7d, 37e0e14128e0685267dc5c037bf655421a6ce2ea ≤ v < 228075f31b141395233218712242913125ace4e0, 37e0e14128e0685267dc5c037bf655421a6ce2ea ≤ v < a4cef20cd473e0640fefd38094d4baac0ec76ae3, 37e0e14128e0685267dc5c037bf655421a6ce2ea ≤ v < adeee7187694719890aaffdc14b7e89cfd736f1d, 6.5 | d6f9af093dc91dac8848a01e417b8109c651c0b2, 1c8e01792adf91879322f1ad752f1814de8b7e7d, 228075f31b141395233218712242913125ace4e0, a4cef20cd473e0640fefd38094d4baac0ec76ae3, adeee7187694719890aaffdc14b7e89cfd736f1d |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.