CVE-2026-53242: Linux Kernel ALSA PCM Wait Queue Corruption Denial of Service

Technical summary

CVE-2026-53242 is a wait queue list corruption vulnerability in the Linux kernel's ALSA PCM subsystem, specifically within the snd_pcm_drain() function. The issue stems from the use of init_waitqueue_entry() and add_wait_queue() with conditional remove_wait_queue() logic that fails to handle edge cases when linked substreams are unlinked concurrently. When a substream is removed from a group during drain iteration, its wait entry remains on the old sleep queue. On subsequent drain iterations, add_wait_queue() enqueues the same entry to a new queue while it is still linked to the old one, causing doubly-linked list corruption. A subsequent wake_up() call dereferences a NULL pointer from the corrupted list structure, resulting in a kernel crash. The fix replaces the problematic sequence with init_wait_entry(), prepare_to_wait(), and finish_wait(), which properly initialize the list head on each iteration and use autoremove semantics to prevent orphaned entries.

Business impact

This vulnerability directly impacts availability for systems relying on ALSA audio subsystem stability. Unprivileged local users can trigger kernel panics by manipulating linked PCM streams, causing immediate service interruption. While no data breach or privilege escalation occurs, repeated exploitation can degrade system reliability and complicate audio service deployment in multi-tenant or shared-resource environments. Organizations running audio-heavy workloads—such as multimedia servers, container hosts, or IoT devices with audio processing—face operational disruption if the kernel becomes unstable.

Affected systems

The vulnerability affects the Linux kernel across multiple versions and distributions that include the ALSA (Advanced Linux Sound Architecture) PCM subsystem. All kernel versions prior to the fix are potentially vulnerable. Affected products are enumerated as linux linux_kernel. Systems with audio interfaces exposed to local users are at highest risk, particularly shared systems, containerized environments, and audio appliances. Embedded systems and IoT devices running affected kernel versions also face exposure.

Exploitability

Exploitation requires local access and basic user-level privileges (no elevated rights needed, as indicated by PR:L in the CVSS vector). An attacker must be able to open and manipulate linked PCM audio streams concurrently, forcing the race condition between stream unlinking and drain operations. The attack is not network-exploitable. While triggering the vulnerability requires some understanding of ALSA stream linkage semantics, the barrier to exploitation is moderate for an unprivileged local user familiar with audio APIs. This is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Apply kernel updates from your Linux distribution that include the fix to snd_pcm_drain(). The patch replaces the vulnerable wait queue handling code with the safer init_wait_entry()/prepare_to_wait()/finish_wait() sequence. Verify the specific kernel version from your vendor's security advisory, as backport timelines vary. Systems unable to update immediately should restrict local user access to audio devices via file permissions and disable unnecessary ALSA subsystem modules if audio functionality is not required.

Patch guidance

Check your distribution's security advisory for the specific kernel version containing this fix. Major distributions (Red Hat, Debian, Ubuntu, SUSE, etc.) will release patched kernels through their standard update channels. Prioritize kernel updates that address this vulnerability alongside other concurrent security fixes. After patching, reboot systems to activate the fixed kernel. For production audio systems, schedule reboots during maintenance windows to minimize service disruption.

Detection guidance

Monitor kernel logs for audio-related panics or BUG messages from the PCM subsystem, particularly those mentioning wait queues or list corruption. Systems experiencing repeated unexpected kernel panics with ALSA in the stack trace may be under exploitation or running vulnerable code. Audit access to audio device files (/dev/snd/*) to identify which users and processes manipulate PCM streams, and correlate unexpected audio stream manipulation with system stability events. In containerized or virtualized environments, monitor for guests or containers repeatedly attempting to trigger audio stream state changes.

Why prioritize this

This vulnerability merits immediate patching despite moderate exploitability barriers. The CVSS score of 7.8 (HIGH) reflects complete compromise of kernel integrity and availability through a low-privilege local vector. The denial-of-service impact is severe—kernel panics directly disrupt service. While exploitation requires local access and familiarity with ALSA, the fix is straightforward and available. Organizations should prioritize this patch alongside other HIGH-severity kernel vulnerabilities as part of their regular update cycle, especially for systems with local user access or audio processing requirements.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) is justified by the HIGH impact on availability (kernel panic), HIGH impact on integrity (memory list corruption), and HIGH impact on confidentiality (potential exposure of kernel memory state through crash analysis). The attack vector is Local (AV:L), attack complexity is Low (AC:L), privileges required are Low (PR:L), and no user interaction is needed (UI:N). The scope is Unchanged (S:U), meaning the impact is confined to the vulnerable system. The combination of reliable DOS capability with a low privilege requirement elevates severity despite the local-only attack surface.

Frequently asked questions