Executive brief
The Linux kernel's ALSA sound subsystem contains a use-after-free vulnerability in PCM stream handling. When linked audio streams are drained and then unlinked, a freed stack frame can be accessed by the scheduler, potentially allowing local denial of service or information disclosure on systems with audio capabilities.
Technical details
The vulnerability is a use-after-free in the ALSA PCM subsystem's snd_pcm_drain() and snd_pcm_unlink() functions. When draining a linked PCM stream, an on-stack wait entry is parked on a peer stream's sleep queue. If group membership changes during the wait and the sleep ends via signal or timeout (rather than normal wake), the entry is not removed from the queue, leaving it queued on the sleep list. When snd_pcm_unlink() is later called, the sleep queues are not woken, allowing the scheduler to eventually access the freed stack frame through the dangling queue entry. The fix adds wake_up() calls on all group members before membership changes, ensuring drainers are released and clean up their entries while streams are still grouped. This requires local access and is triggered through normal PCM operations on linked streams.
Affected products
- Linux Linux kernel Affected kernels from version f57f3df03a8e onward until patched
Timeline
- 2026-08-28: disclosed: CVE-2026-80716 published
- 2026-07-28: patched: Fix developed by Norbert Szetei
- 2026-08-19: other: Patch merged into stable trees by Greg Kroah-Hartman