In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path… (CVE-2026-98742)

The Linux kernel ALSA sequencer ioctl interface had a flaw where the compat port-info ioctl path did not take the client->ioctl_mutex when invoking handlers via snd_seq_kernel_client_ctl(), unlike the native ioctl path which serialized calls with this mutex. This allowed concurrent compat CREATE_PORT requests to pass the port-count check before serialized insertion, causing the computed port index to exceed the address field range and wrap to an existing index. This resulted in duplicate port addresses, and subsequent subscriber teardown could incorrectly resolve to a wrong port, leading to use-after-free of subscriber memory. The fix involved taking the ioctl_mutex while dispatching converted port-info requests, ensuring serialized access to client port state consistent with the native ioctl path.

The vulnerability could lead to use-after-free conditions due to duplicate port addresses caused by concurrent CREATE_PORT requests bypassing serialization. This may allow incorrect subscriber teardown and potential memory corruption within the ALSA sequencer subsystem of the Linux kernel. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to serialize compat port-info ioctl handler calls by taking the ioctl_mutex, matching the native ioctl path behavior. Users should update to a Linux kernel version that includes this fix. Patch status is not explicitly stated; check the vendor or Linux kernel advisories for the exact fixed versions and apply updates accordingly.