Executive brief
The Linux kernel's ALSA sound sequencer OSS interface contains a race condition in its queue reset logic. Concurrent queue operations can cause audio events to be dropped, misrouted, or processed out of order, leading to audio stream corruption or denial of service in applications using OSS sound sequencing.
Technical details
The vulnerability is a data race in the ALSA sequencer OSS readq implementation where snd_seq_oss_readq_clear() modifies queue state (qlen, head, tail, input_time) without holding the q->lock spinlock, while other paths (snd_seq_oss_readq_free(), snd_seq_oss_readq_put_event()) access and modify the same fields under lock. This allows concurrent reset and enqueue/dequeue operations to interleave unsafely, resulting in stale records, dropped events, or incorrect readiness signaling. KCSAN detected a write-read race on the qlen field between reset and free operations. The fix wraps queue reset operations under q->lock and factors enqueue logic into a caller-locked helper so timestamp suppression state updates occur atomically with resets.
Affected products
- Linux Linux kernel affected versions not specified
Timeline
- 2026-08-28: disclosed