CVE-2026-74502

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of outcvts on rawmidi error sndumpattachlegacyrawmidi allocates the legacy conversion array ump-outcvts and, on the sndrawmidinew error path, frees it with kfree but leaves ump-outcvts pointing at the...

CVE-2026-74501

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in umptoendpoint createmidi2ump registers a card-owned sndumpendpoint and stores a back-pointer to its per-interface sndusbmidi2ump object in ump-privatedata, but it never installs an...

CVE-2026-74499

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill-loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a signed int, so a small device-advertised bulk-OUT maxtransfer makes bufe...

CVE-2026-74502

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of outcvts on rawmidi error sndumpattachlegacyrawmidi allocates the legacy conversion array ump-outcvts and, on the sndrawmidinew error path, frees it with kfree but leaves ump-outcvts pointing at the...

CVE-2026-74501

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in umptoendpoint createmidi2ump registers a card-owned sndumpendpoint and stores a back-pointer to its per-interface sndusbmidi2ump object in ump-privatedata, but it never installs an...

EUVD-2026-59694

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in umptoendpoint createmidi2ump registers a card-owned sndumpendpoint and stores a back-pointer to its per-interface sndusbmidi2ump object in ump-privatedata, but it never installs an...

CVE-2026-74501 ALSA: usb-audio: fix use-after-free in ump_to_endpoint()

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in umptoendpoint createmidi2ump registers a card-owned sndumpendpoint and stores a back-pointer to its per-interface sndusbmidi2ump object in ump-privatedata, but it never installs an...

CVE-2026-74499

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill-loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a signed int, so a small device-advertised bulk-OUT maxtransfer makes bufe...

EUVD-2026-59692

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill-loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a signed int, so a small device-advertised bulk-OUT maxtransfer makes bufe...

CVE-2026-74387

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

CVE-2026-74388

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later in sndseqossmidiputc called from sndseqossprocessevent. When it's ...

CVE-2026-72443

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during sndusbmidiv2create. A later setup failure can still jump to sndusbmidiv2free, which currently frees each endpoint and its coheren...

EUVD-2026-59535

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later in sndseqossmidiputc called from sndseqossprocessevent. When it's ...

CVE-2026-74387 ALSA: seq: midi: Serialize output teardown with event_input

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

EUVD-2026-59342

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during sndusbmidiv2create. A later setup failure can still jump to sndusbmidiv2free, which currently frees each endpoint and its coheren...

CVE-2026-72443 ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during sndusbmidiv2create. A later setup failure can still jump to sndusbmidiv2free, which currently frees each endpoint and its coheren...

WordPress midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload

WordPress midi-Synth plugin \u003C= 1.1.0 contains an unrestricted file upload vulnerability caused by missing file type and extension validation in the 'export' AJAX action, letting unauthenticated attackers upload arbitrary files and potentially execute remote code, exploit requires attacker to...

PT-2026-72823

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with event input event process midi borrows msynth-output rfile.output and then passes the substream to dump midi and snd rawmidi kernel write without synchronizing with the output...

PT-2026-72951

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd usbmidi akai output snd usbmidi akai output computes its fill-loop bound buf end = ep-max transfer - MAX AKAI SYSEX LEN - 1; as a signed int, so a small device-advertised bulk-OUT max transfe...

PT-2026-72631

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during snd usb midi v2 create. A later setup failure can still jump to snd usb midi v2 free, which currently frees each endpoint and its...