Executive brief
The Linux kernel ALSA sound subsystem contains a race condition in the Digigram pcxhr audio device driver where interrupt handlers could execute before their associated locks are initialized. An attacker with physical or adjacent access to trigger early interrupts during device probing could cause kernel memory corruption or system instability, potentially leading to denial of service or privilege escalation.
Technical details
The vulnerability is a use-before-initialization race condition in the pcxhr driver's probe function. The pcxhr_probe() routine requests a threaded interrupt handler via request_threaded_irq() before calling mutex_init() to initialize the mgr->lock, mgr->msg_lock, and mgr->setup_mutex structures. If an interrupt fires during this window (possible on some hardware or with adjacent/local access), pcxhr_threaded_irq() will attempt to acquire uninitialized mutexes, leading to undefined behavior. The fix reorders the initialization to call mutex_init() before request_threaded_irq(). The vulnerability was introduced by commit 9bef72bdb26e which changed to nonatomic PCM operations requiring locking.
Affected products
- Linux Linux kernel Versions after 9bef72bdb26e; patched in mainline and stable branches
Timeline
- 2026-09-11: disclosed
- 2026-08-19: patched: Upstream fix committed; stable patches applied 2026-09-14