[CVE-2026-98742][MODERATE 7.0] ALSA: seq: Serialize compat port-info ioctls

[CVE-2026-98742][MODERATE 7.0] ALSA: seq: Serialize compat port-info ioctls

[AL-KERNEL]

CVE: CVE-2026-98742
Priority: MODERATE 7.0
AL-KERNEL base severity: MODERATE
KPANIC flag: YES
Patch: ALSA: seq: Serialize compat port-info ioctls
Commit: 413211dd31cb2ef2fc99fb0aa1a037a97509502c
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=413211dd31cb2ef2fc99fb0aa1a037a97509502c
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98742
Analysis date: Mon, 19 Oct 2026 01:41:49 -0400
ActionableScore: 5
ActionableScore lower bound: unknown
Actionable bucket: Actionable Moderate / Strong Important candidate requiring manual review
Manual review required: YES

Summary:
A repeatable race in ALSA sequencer compat CREATE_PORT handling can wrap the port index to a duplicate address and make subscriber teardown access a freed structured object, creating a local use-after-free that requires mandatory exploitation-leverage review.

======================================================================
ABOUT THIS REPORT
======================================================================

The original Linux kernel CVE announcement for CVE-2026-98742 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98742

The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.

The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.

Published priority for this report: MODERATE 7.0
Manual review required: YES

A detailed explanation of the methodology and priority rules is included
at the end of this message.

======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================

CVE-2026-98742	MODERATE	https://www.kernelcve.org/list/?q=CVE-2026-98742 CHECK WITH IMPACT FROM ORIG NN IMPORTANT | AEGIS IMPACT MODERATE_KPANIC AEGIS_AS=4 LEGACY=MODERATE_KPANIC RESULT=SAME (final reconciliation agrees; DECISION: both MODERATE_KPANIC)	Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H';CWE-362;*CWE-416;CWE-667;Other CVSS 'AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '7';DESCR 'A race condition in the ALSA sequencer compat ioctl path occurs because converted port-info requests call the common handlers without holding client ioctl_mutex. Concurrent compat CREATE_PORT operations can pass the port-count check before insertion, causing the integer port index to exceed the address field range and wrap to an existing port address. Later subscriber teardown can resolve the duplicate address to the wrong port and access a freed subscriber, creating a kernel use-after-free condition. For the CVSS the PR:L is selected because a local user with access to the ALSA sequencer device can invoke the compat ioctls without full administrative privileges. AC:H is selected because reliable triggering requires concurrent requests to hit a race window and a later teardown operation to reach the stale subscriber. The issue is not network reachable. Impact is at least a local denial of service through a kernel crash and in the worst case may include confidentiality and integrity impact or local privilege escalation due to reuse of the freed kernel object. Automated impact decision path. The original SimpleNet classifier selected IMPORTANT. The primary LLM estimated paranoid CVSS 7 and the production ActionableScore returned 5 with recommendation Actionable Moderate / Strong Important candidate requiring manual review. The production rules then evaluated CVSS thresholds and ActionableScore thresholds. Recorded rule transitions were KP and FD specialist checks stage IMPORTANT to MODERATE_KPANIC because FD false positive review allowed a downgrade. The legacy KP specialist produced a review artifact and its decision was processed by the applicable KP rules. The legacy FD or DH downgrade specialist produced a review artifact and its decision was processed by the applicable downgrade and preservation rules. Exact triggered rule markers were DECREASED_TO_MODERATE7_BASED_ON_FALSEPOSCHECKOFDH. The independent weaker Aegis shadow evaluated CVSS 1.7 and ActionableScore 4 with primitive class CLASS_B and manual review REQUIRED. Its independently reconciled impact was MODERATE_KPANIC. The shadow agreed with the final production impact and aggregation did not change that impact. The final reported impact is MODERATE_KPANIC.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Actionable Moderate / Strong Important candidate requiring manual review (with actual score 5)	MAYBE	OOB RACE UAF HARDWARE LINUS KPANIC  DECREASED_TO_MODERATE7_BASED_ON_FALSEPOSCHECKOFDH	-	-	checked

======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================

ActionableScore=5
PrimitiveClass=CLASS_B
RealUAF=YES
HostAdminRequired=NO
NamespaceScopedPrivilege=NO
ImportantCandidate=YES
ManualReview=REQUIRED
AutoDowngradeAllowed=NO
RequiresHostUID0=NO
AuthorizationDecisionBypass=NO
ProtectedResourceImpact=NONE
B4PendingReview=NO
B4PendingConfirmed=NO

1. ActionableScore

* Raw conservative score: 4
* Conservative score: 5
* Applied conservative floor: 4 -> 5 under the real UAF floor because the below-host-admin compat API creates conflicting active objects and later resolves the duplicate address to a freed subscriber.
* Raw paranoid score: 5
* Paranoid score: 5
* No paranoid floor or cap changed the raw score.
* Final recommended bucket: **Actionable Moderate / Strong Important candidate requiring manual review**::

2. Signal breakdown

Conservative signals:

* +2 Real UAF. The commit directly states that duplicate port addresses can make subscriber teardown access a freed subscriber.
* +1 Local unprivileged trigger. A local process with access to the ALSA sequencer device can issue compat CREATE_PORT requests without host-administrator powers.
* +1 Attacker-influenced active-object state and lifetime. The same actor can issue concurrent port creation operations and arrange the port and subscriber lifecycle that produces the stale lookup.
* +1 Reliable kernel crash or strong DoS. Accessing the freed subscriber can realistically fault or corrupt teardown processing.
* -1 Legacy or non-default execution mode. Triggering specifically requires the translated compat ioctl path, normally involving a 32-bit process on a compat-enabled kernel.
* Total: 2 + 1 + 1 + 1 - 1 = 4.
* FLOOR 5 applied because this is not a fixed stale buffer. It is an attacker-induced active-object identity collision followed by use of a freed structured object.

Paranoid-only signal:

* +1 Structured stale-object exploitation leverage. The wrapped address changes object selection, and teardown then consumes a freed subscriber associated with the incorrectly selected port. This supports unresolved post-free object and lifetime processing beyond a simple NULL dereference.
* Paranoid total: 2 + 1 + 1 + 1 + 1 - 1 = 5.

Important non-awarded signals:

* Controlled reclaim or attacker-shaped replacement contents are not demonstrated.
* Arbitrary or directed kernel read or write is not demonstrated.
* Strong LPE leverage is not awarded solely because a UAF exists.
* Confidentiality and integrity points are not awarded because no disclosure, protected-state modification, or controlled write is established.
* No extra Availability point is awarded because it would duplicate the same crash consequence.
* No race penalty is applied. Concurrent CREATE_PORT requests are attacker-driven, repeatable, and cheap rather than a demonstrated narrow one-shot race.
* No concrete repeated release or refcount signal is awarded. The patch establishes access to a freed subscriber but does not show the same reference receiving two lifetime-mutating put, free, or refcount operations.
* Paranoid repeated-refcount leverage is therefore withheld.
* NEW52 B5-R does not apply because no retry-accumulated heap OOB write is established.
* NEW53 B3-PENDING does not apply because no shared-backing write is involved.
* V33 and V32 do not apply because no checksum metadata corruption or networking trust-boundary chain exists.
* B4 authorization-state preservation does not apply because no DENY-to-ALLOW authorization decision is changed.

3. Reachability analysis

The evaluated attacker is a local user or service process that can open the ALSA sequencer device and execute the 32-bit compat port-info ioctls. Full host root, host UID 0, CAP_SYS_ADMIN, and host-admin-equivalent powers are not required by the described ALSA client operations.

The attacker can issue concurrent CREATE_PORT requests against the same client. Those requests can pass the port-count check before serialized insertion, advance the integer index beyond the address-field range, and produce a duplicate wrapped port address. A later subscriber teardown then resolves that address to the wrong port and reaches the freed subscriber.

No namespace capability is part of the trigger, so the operation is not classified as namespace-scoped. No special physical hardware is required, but CONFIG_COMPAT support and access to the ALSA sequencer device are prerequisites. Device-node policy may limit which local accounts can reach the interface, but it does not make the operation host-admin-only.

The race is practically repeatable because the attacker controls both concurrent ioctl submission and related ALSA object operations. The patch does not establish remote or network-triggered reachability.

4. Primitive and severity interpretation

The exact primitive is an active structured-object UAF caused by an identity collision. Concurrent creation permits an integer port index to exceed the address-field range and wrap to an existing index. Subscriber teardown subsequently selects the wrong port and accesses a subscriber whose lifetime has ended.

This is not fixed stale storage. The stale object participates in active ALSA port and subscriber lookup and teardown. It is also stronger than an ordinary NULL dereference because the corrupted identifier changes which live kernel object is selected before the freed subscriber is accessed.

No concrete second release or refcount mutation on the exact same dangling reference is visible. The case therefore does not qualify as repeated-lifetime corruption under the dedicated double-release rule. It remains CLASS_B rather than CLASS_A because controlled reclaim, directed corruption, callback influence, arbitrary read or write, and demonstrated privilege escalation are absent.

The demonstrated consequence is a local kernel UAF with realistic crash or DoS impact. The unresolved consequence is whether allocator reuse and the teardown operations can provide useful memory corruption or local privilege-escalation leverage.

ImportantCandidate is YES because the attacker creates the conflicting active objects, controls repeatable execution of the race, and causes wrong-object resolution followed by access to a freed structured object. AutoDowngradeAllowed is NO because automatically treating this as ordinary crash-only Moderate would discard unresolved exploitation leverage associated with the active-object UAF. This classification preserves an Important candidate for review but does not claim proven Important severity or LPE.

5. One-sentence report phrase

A repeatable race in ALSA sequencer compat CREATE_PORT handling can wrap the port index to a duplicate address and make subscriber teardown access a freed structured object, creating a local use-after-free that requires mandatory exploitation-leverage review.

6. Manual review recommendation

MANUAL CHECK REQUIRED

Review the exact subscriber teardown call chain, stale fields consumed after wrong-port resolution, allocator class and reuse opportunities, device-node permissions, and whether the stale operation modifies list, pointer, or reference state before any fault.

7. Call-site confidence

Call-site confidence: medium

======================================================================
UPSTREAM PATCH SUMMARY
======================================================================

Patch: ALSA: seq: Serialize compat port-info ioctls
Commit: 413211dd31cb2ef2fc99fb0aa1a037a97509502c
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=413211dd31cb2ef2fc99fb0aa1a037a97509502c

Commit description:

The native sequencer ioctl path serializes handler calls with
client->ioctl_mutex, but the translated port-info compat path invokes the
same handlers through snd_seq_kernel_client_ctl() without taking that
mutex.

This lets concurrent compat CREATE_PORT requests pass the port-count
check before any request reaches the serialized insertion. The computed
integer port index can then exceed the address field range and wrap to an
existing index. Subsequent subscriber teardown can resolve the duplicate
address to the wrong port and access a freed subscriber.

Take ioctl_mutex while dispatching converted port-info requests, matching
the native ioctl path. All translated port-info commands share this
helper, so their accesses to the client port state are serialized as
well.

Fixes: b3defb7 ("ALSA: seq: Make ioctls race-free")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol gpt-6-astra
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Bruno Produit <bruno.produit@trailofbits.com>
Link: https://patch.msgid.link/20260917105643.90102-1-bruno.produit@trailofbits.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Changed files:
  sound/core/seq/seq_compat.c

Diff excerpt:

Not included in this email. See the upstream URL for the full patch.

Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=413211dd31cb2ef2fc99fb0aa1a037a97509502c

======================================================================
DETAILED REPORT METHODOLOGY
======================================================================

The original Linux kernel CVE announcement for CVE-2026-98742 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98742

The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.

The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.

The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.

Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:

  Conservative CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
  The Best / paranoid CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  The Best / paranoid CVSS score: 7

The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.

CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.

A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.

  Conservative ActionableScore: unknown
  Paranoid ActionableScore: 5

The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.

For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:

  ActionableScore below 5   -> MODERATE REGULAR
  ActionableScore 5 or more -> MODERATE 7.0

The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.

There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).

KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.

AL-KERNEL base severity for this report: MODERATE
KPANIC detected for this report: YES
Published priority for this report (same as in Subject): MODERATE 7.0

These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).

Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is alexanjelausa@gmail.com (and both
send reply to CVE record itself too and see "reply" button below for howto reply).