Strix
72.7K

CVE-2026-98912

UnknownEPSS 0.19%

Last modified

CVE-2026-98912 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue. The check is inverted. It currently stops when the event is smaller than the remaining buffer, so a normal 4-byte event is not copied for an 8-byte read buffer. EPSS estimates a 0.19% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue. The check is inverted. It currently stops when the event is smaller than the remaining buffer, so a normal 4-byte event is not copied for an 8-byte read buffer. Conversely, an 8-byte event can be copied for a smaller read count. Break only when the remaining userspace buffer is smaller than the next event, and report -EINVAL if no complete event has been copied. This prevents an undersized read from looking like end-of-file while leaving the event queued for a later read with a large enough buffer.

Metrics

EPSS Probability
0.19%

8.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b3b4b647313757a275be7f7f9d0415d0a90acf73; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 591226398c1f93bd994678237ff0be229b19d3bb; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 372bec8a01e2ab8eaa6851bdc346ede5f82dba99; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 2922cf2583e590f51bed613a6fcd27b9aea83674; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 7483fd5f6990f43cc266e94b3f50ce84856ebb97; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 20b8520d1ef996173065f7abdde47b99136c0785; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 611f538253d970f4d152003841544e875828d015
LinuxLinux2.6.12

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98912?
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue. The check is inverted. It currently stops when the event is smaller than the remaining buffer, so a normal 4-byte event is not copied for an 8-byte read buffer. Conversely, an 8-byte event can be copied for a smaller read count. Break only when the remaining userspace buffer is smaller than the next event, and report -EINVAL if no complete event has been copied. This prevents an undersized read from looking like end-of-file while leaving the event queued for a later read with a large enough buffer.
How severe is CVE-2026-98912?
Severity scoring for CVE-2026-98912 is pending analysis. The EPSS model estimates a 0.19% probability of exploitation in the next 30 days.
How do I fix CVE-2026-98912?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98912?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST