# CVE-2026-74387: linux: In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with... CVE-2026-74387 is fixed in 46 products on 1 platform, first by DEBIAN-CVE-2026-74387, released August 15, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-74387 - Priority: High - CVSS: 7.8 (high) - EPSS: 0.0017 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Aug 15, 2026 ## Description In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with event_input event_process_midi() borrows msynth->output_rfile.output and then passes the substream to dump_midi() and snd_rawmidi_kernel_write() without synchronizing with the output open/close transition. midisynth_use() also publishes output_rfile before snd_rawmidi_output_params() has finished. The last midisynth_unuse() can therefore release the same rawmidi file and free substream->runtime before snd_rawmidi_kernel_write1() takes its runtime buffer reference. That leaves the event_input path using a stale substream or runtime and can end in a NULL-deref or use-after-free. Fix this with two pieces of synchronization. Keep a short IRQ-safe spinlock only for publishing or clearing output_rfile and for pairing the output snapshot with an snd_use_lock_t reference. Once event_process_midi() has taken that in-flight reference, it drops the spinlock before calling snd_seq_dump_var_event(), dump_midi(), or snd_rawmidi_kernel_write(). midisynth_unuse() now detaches the visible rawmidi file under the same spinlock, waits for the in-flight writers to drain, and only then drains and releases the saved file. midisynth_use() likewise opens into a local snd_rawmidi_file and publishes it only after snd_rawmidi_output_params() succeeds. The buggy scenario involves two paths, with each column showing the order within that path: event_input path: last unuse path: 1. event_process_midi() snapshots 1. midisynth_unuse() starts output_rfile.output. tearing down output_rfile. 2. dump_midi() reaches 2. snd_rawmidi_kernel_release() snd_rawmidi_kernel_write() closes the output file. before runtime is pinned. 3. close_substream() frees 3. The callback keeps using substream->runtime. the borrowed substream. Validation reproduced this kernel report: KASAN null-ptr-deref in snd_rawmidi_kernel_write1+0x56/0x360 RIP: 0033:0x7fde7dd0837f RIP: 0010:snd_rawmidi_kernel_write1+0x56/0x360 ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | kernel-64kb sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-azure sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-default sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-default-base sles 15.7 | 6.4.0-150700.53.90.1.150700.17.51.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-docs sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-livepatch-SLE15-SP7_Update_24 sles 15.7 | 1-150700.15.3.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-obs-build sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-source sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-syms sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-uek ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-core ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-core ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-core ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-core ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-devel ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-devel ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules-core ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules-core ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules-deprecated ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules-deprecated ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules-desktop ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules-desktop ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules-extra ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules-extra ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules-extra-netfilter ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules-extra-netfilter ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules-usb ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules-usb ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules-wireless ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-debug-modules-wireless ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-devel ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-devel ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-doc ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-doc ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules-core ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules-core ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules-deprecated ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules-deprecated ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules-desktop ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules-desktop ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules-extra ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules-extra ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules-extra-netfilter ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules-extra-netfilter ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules-usb ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules-usb ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules-wireless ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-modules-wireless ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-tools ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek-tools ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-core ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-core ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-devel ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-devel ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules-core ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules-core ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules-deprecated ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules-deprecated ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules-desktop ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules-desktop ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules-extra ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules-extra ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules-extra-netfilter ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules-extra-netfilter ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules-usb ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules-usb ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules-wireless ol 10 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-uek64k-modules-wireless ol 9 | 0:6.12.0-206.104.3.3.el9uek | [ELSA-2026-500248](https://patchblox.com/security/data/fix/linux/elsa-2026-500248.md) | Sep 4, 2026 | | Linux | kernel-zfcpdump sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | linux Debian 12.15 (bookworm) | 6.1.180-1 | [DEBIAN-CVE-2026-74387](https://patchblox.com/security/data/fix/linux/debian-cve-2026-74387.md) | Aug 15, 2026 | | Linux | linux Debian 13.5 (trixie) | 6.12.100-1 | [DEBIAN-CVE-2026-74387](https://patchblox.com/security/data/fix/linux/debian-cve-2026-74387.md) | Aug 15, 2026 | | Linux | linux Debian 14 | 7.1.5-1 | [DEBIAN-CVE-2026-74387](https://patchblox.com/security/data/fix/linux/debian-cve-2026-74387.md) | Aug 15, 2026 | --- Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.