CVE-2026-53242 - Vulnerability Details

- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

snd_pcm_drain() uses init_waitqueue_entry which does not clear
entry.prev/next, and add_wait_queue with a conditional
remove_wait_queue that is skipped when to_check is no longer
in the group after concurrent UNLINK. The orphaned wait entry
remains on the unlinked substream sleep queue. On the next
drain iteration, add_wait_queue adds the entry to a new queue
while still linked on the old one, corrupting both lists. A
subsequent wake_up dereferences NULL at the func pointer
(mapped from the spinlock at offset 0 of the misinterpreted
wait_queue_head_t), causing a kernel panic.

Replace init_waitqueue_entry/add_wait_queue/conditional
remove_wait_queue with init_wait_entry/prepare_to_wait/
finish_wait. init_wait_entry clears prev/next via
INIT_LIST_HEAD on each iteration and sets
autoremove_wake_function which auto-removes the entry on
wake-up. finish_wait safely handles both the already-removed
and still-queued cases.

Published: 2026-06-25

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the ALSA PCM subsystem of the Linux kernel, the function snd_pcm_drain() can corrupt the wait‑queue list when applied to linked audio streams. This corruption corrupts the internal queue structure and causes a null‑pointer dereference during a subsequent wake‑up, resulting in a kernel panic. The flaw is typified by CWE‑824 and leads directly to denial of service by crashing the kernel.

Affected Systems

All builds of the Linux kernel that include the ALSA PCM subsystem and have not yet merged the commit that replaces init_waitqueue_entry/add_wait_queue with init_wait_entry/prepare_to_wait/finish_wait are affected. This encompasses prior stable releases of both 5.x and 6.x series kernels until the wait‑queue fix is incorporated.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity. The EPSS score of less than 1% and the absence from CISA KEV suggest that exploitation is currently unlikely. Based on the description, it is inferred that triggering the flaw requires a user‑space process that calls snd_pcm_drain() on a linked stream, which is a local and privileged exploitation scenario. An attacker with local access or the ability to run arbitrary code in the user space can exploit the bug to crash the kernel, but no known remote exploitation technique is documented.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9baee36e8c5443411c4629afabafaff8a46a23fd`	affected	< cac5bf3500ee6422cf64e0df0b5daeecfed42917
`fc71f888994569f87d5bee20b1ac6c9c1e3a7a79`	affected	< d842f26a167e77a36f3ed333b9fa99d36ef99fe6
`629cf09464cf98670996ea5c191dc9743e6f3f00`	affected	< d68b621bb5a48051932f1017a6e1bc9b18f854d0
`ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432`	affected	< b053fcd8912f06c30f932f5b8ec41c72de474695
`4a758e9a1f5ed722f83c4dd35f867fe811553bcb`	affected	< cd98837db15f323463b8df07282ac723bd5c3fed
`9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6`	affected	< 7c71a9522555ff137a9ca36b15d759ca04d84788
`9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6`	affected	< 88fe2e3658726cb21ff2dcf9770bf672f9b9d31b
`c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694`	affected	—
`5.10.253`	affected	< 5.10.259
`6.1.167`	affected	< 6.1.176
`6.6.130`	affected	< 6.6.143
`6.12.78`	affected	< 6.12.94
`6.18.19`	affected	< 6.18.36
`6.19.9`	affected	< 6.20

Linux

affected

Version	Status	Constraints
`7.0`	affected	—
`0`	unaffected	< 7.0
`5.10.259`	unaffected	≤ 5.10.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9baee36e8c5443411c4629afabafaff8a46a23fd,cac5bf3500ee6422cf64e0df0b5daeecfed42917)`	affected	code_commit	—
`[fc71f888994569f87d5bee20b1ac6c9c1e3a7a79,d842f26a167e77a36f3ed333b9fa99d36ef99fe6)`	affected	code_commit	—
`[629cf09464cf98670996ea5c191dc9743e6f3f00,d68b621bb5a48051932f1017a6e1bc9b18f854d0)`	affected	code_commit	—
`[ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432,b053fcd8912f06c30f932f5b8ec41c72de474695)`	affected	code_commit	—
`[4a758e9a1f5ed722f83c4dd35f867fe811553bcb,cd98837db15f323463b8df07282ac723bd5c3fed)`	affected	code_commit	—
`[9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6,7c71a9522555ff137a9ca36b15d759ca04d84788)`	affected	code_commit	—
`[9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6,88fe2e3658726cb21ff2dcf9770bf672f9b9d31b)`	affected	code_commit	—
`c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694`	affected	code_commit	—
`[5.10.253,5.10.259)`	affected	semver	—
`[6.1.167,6.1.176)`	affected	semver	—
`[6.6.130,6.6.143)`	affected	semver	—
`[6.12.78,6.12.94)`	affected	semver	—
`[6.18.19,6.18.36)`	affected	semver	—
`[6.19.9,6.20)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`7.0`	affected	generic	—
`[0,7.0)`	unaffected	generic	—
`[5.10.259,5.10.*]`	unaffected	generic	—
`[6.1.176,6.1.*]`	unaffected	generic	—
`[6.6.143,6.6.*]`	unaffected	generic	—
`[6.12.94,6.12.*]`	unaffected	generic	—
`[7.0.13,*]`	unaffected	generic	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that contains the ALSA PCM wait‑queue fix, which replaced the old wait‑queue handling code.
If a kernel upgrade cannot be performed immediately, restrict or sandbox applications that may invoke snd_pcm_drain() on linked streams, or disable linked stream handling in the ALSA configuration to prevent the vulnerability from being exercised.
Implement kernel crash monitoring and alerting to detect panics caused by this flaw; rapid detection enables isolation and remediation of affected hosts.

Generated by OpenCVE AI on June 28, 2026 at 15:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00138.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/7c71a9522555ff137a9ca36b15d759ca04d84788
https://git.kernel.org/stable/c/88fe2e3658726cb21ff2dcf9770bf672f9b9d31b
https://git.kernel.org/stable/c/b053fcd8912f06c30f932f5b8ec41c72de474695
https://git.kernel.org/stable/c/cac5bf3500ee6422cf64e0df0b5daeecfed42917
https://git.kernel.org/stable/c/cd98837db15f323463b8df07282ac723bd5c3fed
https://git.kernel.org/stable/c/d68b621bb5a48051932f1017a6e1bc9b18f854d0
https://git.kernel.org/stable/c/d842f26a167e77a36f3ed333b9fa99d36ef99fe6
https://lore.kernel.org/linux-cve-announce/2026062511-CVE-2026-53242-45ab@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53242
https://www.cve.org/CVERecord?id=CVE-2026-53242

History

Sun, 28 Jun 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 26 Jun 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://lore.kernel.org/linux-cve-announce/2026062511-CVE-2026-53242-45ab@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53242 https://www.cve.org/CVERecord?id=CVE-2026-53242
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Thu, 25 Jun 2026 11:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams snd_pcm_drain() uses init_waitqueue_entry which does not clear entry.prev/next, and add_wait_queue with a conditional remove_wait_queue that is skipped when to_check is no longer in the group after concurrent UNLINK. The orphaned wait entry remains on the unlinked substream sleep queue. On the next drain iteration, add_wait_queue adds the entry to a new queue while still linked on the old one, corrupting both lists. A subsequent wake_up dereferences NULL at the func pointer (mapped from the spinlock at offset 0 of the misinterpreted wait_queue_head_t), causing a kernel panic. Replace init_waitqueue_entry/add_wait_queue/conditional remove_wait_queue with init_wait_entry/prepare_to_wait/ finish_wait. init_wait_entry clears prev/next via INIT_LIST_HEAD on each iteration and sets autoremove_wake_function which auto-removes the entry on wake-up. finish_wait safely handles both the already-removed and still-queued cases.
Title		ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/7c71a9522555ff137a9ca36b15d759ca04d84788 https://git.kernel.org/stable/c/88fe2e3658726cb21ff2dcf9770bf672f9b9d31b https://git.kernel.org/stable/c/b053fcd8912f06c30f932f5b8ec41c72de474695 https://git.kernel.org/stable/c/cac5bf3500ee6422cf64e0df0b5daeecfed42917 https://git.kernel.org/stable/c/cd98837db15f323463b8df07282ac723bd5c3fed https://git.kernel.org/stable/c/d68b621bb5a48051932f1017a6e1bc9b18f854d0 https://git.kernel.org/stable/c/d842f26a167e77a36f3ed333b9fa99d36ef99fe6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:39:37.129Z

Updated: 2026-06-28T06:40:49.406Z

Reserved: 2026-06-09T07:44:35.393Z

Link: CVE-2026-53242

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53242 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-28T15:15:05Z

Weaknesses

CWE-824
Access of Uninitialized Pointer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object