The Linux kernel ALSA sequencer function snd_seq_event_dup() improperly handles the copying of legacy events by not zeroing a trailing 4-byte word in the event cell when the copied size equals the size of the legacy event structure. Because the cell pool memory is allocated without zeroing and reused, this results in leaking uninitialized kernel heap data. When such a cell is delivered to a UMP-enabled client that disables conversion, the stale data is copied to userspace, causing an information leak. The fix involves comparing the copied size against the size of the UMP cell rather than the legacy event, ensuring the trailing word is zeroed for all shorter events.

This vulnerability allows an unprivileged user with access to /dev/snd/seq to obtain a 4-byte kernel heap information leak. The leaked data consists of uninitialized or leftover kernel heap memory, which could potentially aid in further attacks such as kernel address space layout randomization (KASLR) bypass or other exploit primitives. There is no indication of privilege escalation or code execution from this leak alone.

A fix has been implemented in the Linux kernel to correct the size comparison logic in snd_seq_event_dup(), ensuring the trailing word is zeroed for all relevant events. Users should apply the official kernel update that includes this fix. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly provided here; check the vendor or kernel mailing list advisories for the specific fixed kernel versions.