Executive brief
The Linux kernel's audio subsystem (ALSA) contains a race condition in the PCM (pulse code modulation) trigger mechanism. An attacker with local access could exploit this vulnerability by manipulating concurrent audio operations, potentially causing system crashes, denial of service, or unexpected behavior in audio processing on affected systems.
Technical details
This is a race condition vulnerability in the Linux kernel's ALSA PCM subsystem between atomic and non-atomic operations. The vulnerability exists in the interaction between hw_params/hw_free/prepare operations (non-atomic) and the PCM trigger-start command (atomic). The root cause is insufficient synchronization when the trigger-start (PCM_TRIGGER_START) is issued during non-atomic PCM operations, allowing concurrent state transitions that lead to inconsistent internal state (e.g., ODEBUG warnings and potential memory corruption). The fix leverages the existing snd_pcm_buffer_access_lock() mechanism by having the PCM trigger check the runtime->buffer_accessing flag to prevent execution during concurrent non-atomic operations. The attack requires local code execution capability to trigger the race condition.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-16: disclosed