CVE-2026-64029 Linux CVE debrief

Who should care

Users of the Linux kernel should be aware of this vulnerability and ensure they are running a patched version. This includes Linux kernel developers, maintainers, and users who rely on the Linux kernel for their systems. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and take necessary steps to mitigate it.

Technical summary

The vulnerability was caused by a lack of synchronization between the first-open and last-close transition in seq_ump_client_open() and seq_ump_client_close(). This could lead to a use-after-free issue in snd_rawmidi_kernel_write1(). The fix adds a per-client rwlock for the event_input-visible output file, publishing a newly opened output file under the write side, and holding the read side from the output lookup through snd_rawmidi_kernel_write(). The Linux kernel maintainers also provided additional details about the vulnerability and the fix through the Linux kernel mailing list. The patch adds a per-client rwlock for the event_input-visible output file, which prevents the use-after-free issue in snd_rawmidi_kernel_write1().

Defensive priority

High

Recommended defensive actions

• Apply the patch to the Linux kernel
• Ensure the Linux kernel is updated to a patched version
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported through the Linux kernel mailing list and was patched by the Linux kernel maintainers. The patch adds a per-client rwlock for the event_input-visible output file, publishing a newly opened output file under the write side, and holding the read side from the output lookup through snd_rawmidi_kernel_write(). This fix prevents the use-after-free issue in snd_rawmidi_kernel_write1(). The Linux kernel maintainers also provided additional details about the vulnerability and the fix through the Linux kernel mailing list.

Official resources