CVE-2026-46157

Technical summary

The vulnerability is a data race in the ALSA PCM OSS subsystem affecting the runtime.oss.trigger bit field. Without mutual exclusion, concurrent access to this field by snd_pcm_oss_get_trigger() and snd_pcm_oss_poll() can cause non-atomic writes that overwrite adjacent bit fields. Since bit fields in C can share underlying storage, unsynchronized modifications corrupt related state, leading to undefined behavior in PCM operation control. The fix involves protecting both access paths with the existing params_lock mutex to serialize all reads and writes to the trigger bit.

Business impact

Exploitation could disrupt audio services on affected Linux systems, potentially affecting voice communication, streaming applications, conferencing platforms, and any workload relying on PCM audio playback or recording. On systems where audio is critical to business operations—such as VoIP infrastructure, real-time media servers, or containerized audio processing—successful exploitation may cause denial of service. The local privilege requirement limits blast radius to authenticated users or compromised processes running with at least standard user permissions.

Affected systems

This vulnerability affects the Linux kernel across all distributions and versions where the ALSA PCM OSS subsystem is compiled in and in use. The bug is in core kernel code, so any Linux system with ALSA and OSS support enabled is potentially vulnerable until patched. Embedded devices, IoT systems, and server platforms running vulnerable kernel versions are all in scope. Verify your kernel version and ALSA configuration against your vendor's advisory for definitive affected version ranges.

Exploitability

Exploitation requires local system access and at least unprivileged user-level privileges. An attacker would need to trigger rapid concurrent access to ALSA PCM OSS interfaces—feasible through multi-threaded or multi-process abuse of audio-related syscalls. No network vector exists. The vulnerability is unlikely to be weaponized for widespread remote exploitation due to local-only access requirement, but it poses material risk in multi-tenant or high-concurrency audio environments. The CVSS 7.8 HIGH score reflects confidentiality, integrity, and availability impact under local attack conditions.

Remediation

Apply kernel security updates from your Linux distribution as soon as they become available. The fix requires recompiling and redeploying the kernel with the patch applied, followed by a reboot to activate the corrected code. Organizations should prioritize patching systems where ALSA OSS is actively used, particularly audio servers, containerized environments, and user-facing systems. Verify patch availability via your vendor's security advisory.

Patch guidance

Monitor your Linux distributor's security bulletins and kernel release notes for updates addressing CVE-2026-46157. Test patches in a non-production environment first to confirm audio subsystem stability and compatibility with dependent applications. Once validated, schedule kernel updates during maintenance windows that accommodate service restarts. Confirm the updated kernel is running post-reboot by checking /proc/version or uname output. If OSS is not required for your workloads, disabling ALSA OSS support at compile time or via kernel parameters may be an interim control.

Detection guidance

Monitor system logs for ALSA or audio-related warnings, crashes, or anomalous behavior following concurrent audio operations. Tools like kernel memory debuggers (KASAN, if available in your build) may flag the race condition during testing. Endpoint detection should flag unusual patterns of repeated audio subsystem access or PCM device polling by non-standard processes. Network-based detection is not applicable since this is a local kernel vulnerability; focus on behavioral and log-based signals indicating audio subsystem abuse.

Why prioritize this

Despite its local-only nature, the HIGH severity (CVSS 7.8) reflects significant impact: the bug corrupts adjacent kernel state, potentially affecting system stability and confidentiality. Organizations running audio workloads or multi-tenant systems with untrusted users should prioritize this patch. It is not currently in the KEV list, but that does not reduce the technical risk. Combine threat modeling with asset inventory: prioritize any system where ALSA OSS is actively used or where local privilege escalation chains could amplify impact.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) is assigned because: (1) Attack Vector is Local, reflecting the access requirement; (2) Attack Complexity is Low, indicating straightforward concurrent access triggers the flaw; (3) Privileges Required is Low, meaning standard users can exploit it; (4) User Interaction is None; (5) Scope is Unchanged; (6) Confidentiality, Integrity, and Availability are all rated High, as bit field corruption can leak kernel memory, corrupt audio state, and crash the subsystem. The score appropriately balances local-only access against high-impact effects on system state and availability.

Frequently asked questions