AZL-104622
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-104622.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-104622
- Upstream
- Published
- 2026-09-25T11:17:38Z
- Modified
- 2026-09-28T05:39:54Z
- Summary
- CVE-2026-98086 affecting package kernel 6.6.157.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ump: do not touch legacy_rmidi before it exists
snd_ump_parse_endpoint() sets ump->parsed on every exit, including error, before the caller attaches the legacy rawmidi device. ump_handle_ep_name_msg() then treats parsed as "legacy_rmidi is live" and calls ump_legacy_set_rawmidi_name(), which snprintf()s into ump->legacy_rmidi->name. If a UMP packet arrives in that window (IRQ path from snd_ump_receive), legacy_rmidi is still NULL (KASAN null-ptr-deref in snprintf).
Guard the legacy helpers. parsed only means endpoint info was parsed, not that legacy_rmidi exists.
- References