SB20260918449 - Insertion of Sensitive Information Into Sent Data in Linux kernel core seq

Description

This security bulletin contains information about 1 vulnerability.

1) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-90220)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper sanitization of an embedded variable-length event in bounce_error_event() when reading a bounce event for a queued variable-length event sent to a nonexistent port. A local user can set SNDRV_SEQ_FILTER_BOUNCE, queue a variable-length event, and read the bounce event to disclose sensitive information.

The disclosure consists of eight bytes on 64-bit systems from the client's own pool.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/42c3f856d13a91a0d4c302a0c6854813621136db
• https://git.kernel.org/stable/c/59e1592d3c270ff4642d5d6dc55c545306eb0693
• https://git.kernel.org/stable/c/6e6e471eef1d5d8cb056c7d364023fe048249204
• https://git.kernel.org/stable/c/b1e8d40663997aacaa198f37ce6893e07aaba77a