Executive brief
A vulnerability in the Linux kernel's sound subsystem could allow a local user to cause a system crash. The issue occurs when handling multiple linked audio streams, leading to internal memory corruption during certain audio operations. This results in a kernel panic, which immediately halts the operating system and disrupts all running services.
Technical details
A race condition exists in the ALSA PCM implementation within `sound/core/pcm_native.c`. The function `snd_pcm_drain()` uses `init_waitqueue_entry`, which fails to clear list pointers, combined with a conditional `remove_wait_queue` that can be bypassed if a concurrent `UNLINK` operation occurs. This leaves an orphaned wait entry on a substream's sleep queue. Subsequent iterations cause list corruption when the entry is added to a new queue while still linked to the old one. This eventually leads to a NULL pointer dereference during a `wake_up` call, resulting in a kernel panic. The fix replaces the vulnerable wait queue logic with `init_wait_entry`, `prepare_to_wait`, and `finish_wait` to ensure safe list management.
Affected products
- Linux Linux 5.10.253 to 5.10.259; 6.1.x; 6.6.x; 6.11.x; 6.12.x; 7.0.x
Timeline
- 2026-06-04: other: Vulnerability fixed in upstream source code
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/7c71a9522555ff137a9ca36b15d759ca04d84788
- https://git.kernel.org/stable/c/88fe2e3658726cb21ff2dcf9770bf672f9b9d31b
- https://git.kernel.org/stable/c/b053fcd8912f06c30f932f5b8ec41c72de474695
- https://git.kernel.org/stable/c/cac5bf3500ee6422cf64e0df0b5daeecfed42917
- https://git.kernel.org/stable/c/cd98837db15f323463b8df07282ac723bd5c3fed
- https://git.kernel.org/stable/c/d68b621bb5a48051932f1017a6e1bc9b18f854d0
- https://git.kernel.org/stable/c/d842f26a167e77a36f3ed333b9fa99d36ef99fe6