Executive brief
The Linux kernel's ALSA sound driver for Harmony audio hardware registers an interrupt handler before initializing synchronization locks. If an interrupt fires during this race window, the handler attempts to use uninitialized locks, causing kernel crashes or undefined behavior that could disrupt audio services or allow privilege escalation on affected systems.
Technical details
This is a race condition in the ALSA harmony driver (sound/parisc/harmony.c). The snd_harmony_create() function calls request_irq() to register the interrupt handler before calling spin_lock_init() on h->lock and h->mixer_lock. If a hardware interrupt arrives before the locks are initialized, snd_harmony_interrupt() will attempt to acquire uninitialized locks, leading to undefined behavior, kernel panics, or memory corruption. The fix moves both spin_lock_init() calls to occur before request_irq(). The vulnerability affects all kernel versions with the Harmony driver (since Linux 2.6.12) until patched. Network attack is not possible; local attackers or hardware events can trigger the race window.
Affected products
- Linux Linux kernel 2.6.12 through unpatched versions
Timeline
- 2026-09-16: disclosed
- 2026-08-31: patched: Commit 33abb7491e89285a41565670945293dda841afc4