CVE-2026-89979 - Vulnerability Details

- ALSA: pcm: Fix race between non-atomic ops and trigger-start

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: Fix race between non-atomic ops and trigger-start

We protect the races of the concurrent state transitions between
atomic PCM ops, but the checks between the non-atomic ops (hw_params,
hw_free and prepare) and the atomic ops aren't perfect; there is a
check of the conflicting PCM state at the beginning of hw_params & co,
but the atomic PCM ops can be still issued during the non-atomic PCM
operations. An example such scenario is that a thread A re-issues the
PREPARE or HW_PARAMS for the already prepared stream, while another
thread B triggers the PCM start in the middle of the prepare
operation. Although this usually doesn't lead to much serious issues,
it can give some inconsistency as reported by syzkaller (such as
ODEBUG warning).

There are various atomic PCM ops, and basically the only problem is
the PCM start as it operates from the PREPARED state. Other trigger
commands (stop, etc) are for the running or the other special state,
hence they are filtered as pre-condition.

This patch is for preventing the PCM trigger-start during the non-
atomic operations in order to address the problems above.
Fortunately, the hw_params, hw_free and prepare operations call
snd_pcm_buffer_access_lock(), and this can be used for checking the
concurrent operations at the PCM trigger -- which sets the
runtime->buffer_accessing to a negative (if possible), so the PCM
trigger just needs to check the runtime->buffer_accessing value; if
it's negative, it means the concurrent non-atomic PCM ops is running.

Published: 2026-09-16

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition exists between non‑atomic ALSA PCM operations (hw_params, hw_free, prepare) and the atomic trigger‑start action. When two threads interleave a prepare request with a start trigger, the kernel may leave a PCM stream in an inconsistent state, causing warnings (e.g., ODEBUG) and potentially leading to driver crashes or malformed audio streams. This instability can be used to interrupt audio services, effectively denying proper audio functionality to applications.

Affected Systems

The flaw affects the ALSA PCM subsystem in the Linux kernel. All kernel releases prior to the inclusion of the race‑fix patch are susceptible, as the driver code does not guard against simultaneous non‑atomic operations and trigger requests. The issue is confined to the Linux:Linux vendor, impacting the core kernel audio components.

Risk and Exploitability

The CVSS score of 7.8 reflects a high severity, but the EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. Exploitation requires a local attacker with sufficient privileges to spawn concurrent audio threads; the attack vector is therefore limited to local processes that use the ALSA API. Given the low EPSS and local nature, the overall risk is moderate but still significant enough to warrant prompt patching.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b1d12144557fceed5de6e22e2c2e30a40ed37702
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b2edc017f94c08bdd0b046a586e43ac771a2f942
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b599e7f16441386754ec083fa62a549bccb02fca
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ad29779736cfd6f5595f0cab300dd7611418e363
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 5abeb4f9f2023f001d693b4e5e1ebbf25e25d0eb
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 7ad2ea7c10044b08ecf7b04376916faf12e17a99
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 50afadf1ea66597116eb14e73c24da7ae99b759f
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< acac7b5e07349a9d10d78873afb4b93cd1dc721f

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3-rc2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b1d12144557fceed5de6e22e2c2e30a40ed37702)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b2edc017f94c08bdd0b046a586e43ac771a2f942)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b599e7f16441386754ec083fa62a549bccb02fca)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ad29779736cfd6f5595f0cab300dd7611418e363)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5abeb4f9f2023f001d693b4e5e1ebbf25e25d0eb)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7ad2ea7c10044b08ecf7b04376916faf12e17a99)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,50afadf1ea66597116eb14e73c24da7ae99b759f)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,acac7b5e07349a9d10d78873afb4b93cd1dc721f)`	affected	code_commit	—
`[0,5.10.270)`	affected	semver	—
`[0,5.15.221)`	affected	semver	—
`[0,6.1.188)`	affected	semver	—
`[0,6.6.157)`	affected	semver	—
`[0,6.12.110)`	affected	semver	—
`[0,6.18.51)`	affected	semver	—
`[0,7.2.5)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[0,5.10.*]`	unaffected	generic	—
`[0,5.15.*]`	unaffected	generic	—
`[0,6.1.*]`	unaffected	generic	—
`[0,6.6.*]`	unaffected	generic	—
`[0,6.12.*]`	unaffected	generic	—
`[0,6.18.*]`	unaffected	generic	—
`[0,7.2.*]`	unaffected	generic	—
`[7.3-rc2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that includes the ALSA PCM race‑condition fix.
If an immediate kernel upgrade is not possible, ensure that your ALSA driver stack is at the latest stable revision to include the concurrency guard.
Monitor system logs for ODEBUG or driver warnings and restart audio services if unexpected behavior is detected.

Generated by OpenCVE AI on September 18, 2026 at 04:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/50afadf1ea66597116eb14e73c24da7ae99b759f
https://git.kernel.org/stable/c/5abeb4f9f2023f001d693b4e5e1ebbf25e25d0eb
https://git.kernel.org/stable/c/7ad2ea7c10044b08ecf7b04376916faf12e17a99
https://git.kernel.org/stable/c/acac7b5e07349a9d10d78873afb4b93cd1dc721f
https://git.kernel.org/stable/c/ad29779736cfd6f5595f0cab300dd7611418e363
https://git.kernel.org/stable/c/b1d12144557fceed5de6e22e2c2e30a40ed37702
https://git.kernel.org/stable/c/b2edc017f94c08bdd0b046a586e43ac771a2f942
https://git.kernel.org/stable/c/b599e7f16441386754ec083fa62a549bccb02fca

History

Wed, 16 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 16 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix race between non-atomic ops and trigger-start We protect the races of the concurrent state transitions between atomic PCM ops, but the checks between the non-atomic ops (hw_params, hw_free and prepare) and the atomic ops aren't perfect; there is a check of the conflicting PCM state at the beginning of hw_params & co, but the atomic PCM ops can be still issued during the non-atomic PCM operations. An example such scenario is that a thread A re-issues the PREPARE or HW_PARAMS for the already prepared stream, while another thread B triggers the PCM start in the middle of the prepare operation. Although this usually doesn't lead to much serious issues, it can give some inconsistency as reported by syzkaller (such as ODEBUG warning). There are various atomic PCM ops, and basically the only problem is the PCM start as it operates from the PREPARED state. Other trigger commands (stop, etc) are for the running or the other special state, hence they are filtered as pre-condition. This patch is for preventing the PCM trigger-start during the non- atomic operations in order to address the problems above. Fortunately, the hw_params, hw_free and prepare operations call snd_pcm_buffer_access_lock(), and this can be used for checking the concurrent operations at the PCM trigger -- which sets the runtime->buffer_accessing to a negative (if possible), so the PCM trigger just needs to check the runtime->buffer_accessing value; if it's negative, it means the concurrent non-atomic PCM ops is running.
Title		ALSA: pcm: Fix race between non-atomic ops and trigger-start
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/50afadf1ea66597116eb14e73c24da7ae99b759f https://git.kernel.org/stable/c/5abeb4f9f2023f001d693b4e5e1ebbf25e25d0eb https://git.kernel.org/stable/c/7ad2ea7c10044b08ecf7b04376916faf12e17a99 https://git.kernel.org/stable/c/acac7b5e07349a9d10d78873afb4b93cd1dc721f https://git.kernel.org/stable/c/ad29779736cfd6f5595f0cab300dd7611418e363 https://git.kernel.org/stable/c/b1d12144557fceed5de6e22e2c2e30a40ed37702 https://git.kernel.org/stable/c/b2edc017f94c08bdd0b046a586e43ac771a2f942 https://git.kernel.org/stable/c/b599e7f16441386754ec083fa62a549bccb02fca

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T10:32:56.643Z

Updated: 2026-09-17T09:29:21.460Z

Reserved: 2026-09-11T19:38:34.779Z

Link: CVE-2026-89979

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T11:17:08.770

Modified: 2026-09-17T10:17:05.353

Link: CVE-2026-89979

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-18T04:15:02Z

Weaknesses

No weakness.

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object