Executive brief
A vulnerability exists in the Linux kernel's sound subsystem (ALSA) that could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when the system handles audio streams that are being closed and drained simultaneously. This could lead to a loss of system availability or unauthorized access to sensitive data.
Technical details
A use-after-free vulnerability exists in sound/core/pcm_native.c within the snd_pcm_drain() function. The root cause is a race condition where a linked stream's runtime object is accessed after its lock is released, but before it is properly protected by a reference count. A concurrent close() operation on the linked stream can trigger kfree(runtime), leading to a stale pointer dereference when the drain loop attempts to access fields like no_period_wakeup, rate, and buffer_size. Local attackers can exploit this by timing stream operations to trigger the race. Patches have been released for multiple stable kernel branches to cache the required fields while the lock is still held.
Affected products
- Linux Linux Kernel versions from 3.0 up to 5.10.253; 5.11 up to 6.1.167; 6.2 up to 6.6.130; 6.7 up to 6.12.78; 6.13 up to 6.18.19; 6.19 up to 6.19.9
Timeline
- 2026-03-05: other: Patch authored
- 2026-05-08: disclosed: Initial publication date
- 2026-05-08: advisory
References
- https://git.kernel.org/stable/c/4a758e9a1f5ed722f83c4dd35f867fe811553bcb
- https://git.kernel.org/stable/c/629cf09464cf98670996ea5c191dc9743e6f3f00
- https://git.kernel.org/stable/c/9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6
- https://git.kernel.org/stable/c/9baee36e8c5443411c4629afabafaff8a46a23fd
- https://git.kernel.org/stable/c/ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432
- https://git.kernel.org/stable/c/c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694
- https://git.kernel.org/stable/c/fc71f888994569f87d5bee20b1ac6c9c1e3a7a79