{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-53242", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-53242" ], "published": "2026-06-25T08:41:40Z", "summary": "ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams\n\nsnd_pcm_drain() uses init_waitqueue_entry which does not clear\nentry.prev/next, and add_wait_queue with a conditional\nremove_wait_queue that is skipped when to_check is no longer\nin the group after concurrent UNLINK. The orphaned wait entry\nremains on the unlinked substream sleep queue. On the next\ndrain iteration, add_wait_queue adds the entry to a new queue\nwhile still linked on the old one, corrupting both lists. A\nsubsequent wake_up dereferences NULL at the func pointer\n(mapped from the spinlock at offset 0 of the misinterpreted\nwait_queue_head_t), causing a kernel panic.\n\nReplace init_waitqueue_entry/add_wait_queue/conditional\nremove_wait_queue with init_wait_entry/prepare_to_wait/\nfinish_wait. init_wait_entry clears prev/next via\nINIT_LIST_HEAD on each iteration and sets\nautoremove_wake_function which auto-removes the entry on\nwake-up. finish_wait safely handles both the already-removed\nand still-queued cases.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.12.87-1+rpt1~bookworm", "1:6.12.93-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.12.87+rpt-rpi-2712", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v6", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v7", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v7l", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v8", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v8-rt", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-2712", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v6", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v7", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v7l", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v8", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v8-rt", "binary_version": "1:6.12.93-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.12.87-1+rpt1~bookworm": { "linux_commit": "ae4d75fb36deba0fe1a986d9bfae65755e082dd0", "upstream_version": "6.12.87", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.94" }, "1:6.12.93-1+rpt1": { "linux_commit": "d8ab4e908235da7727f22dd36ad5af224671677d", "upstream_version": "6.12.93", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.94" } } } }, { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.36" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.36" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.36" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53242" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/cac5bf3500ee6422cf64e0df0b5daeecfed42917" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/06eca2235a3fd281dddf25b0a97772b25b5bb573" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/d842f26a167e77a36f3ed333b9fa99d36ef99fe6" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/d68b621bb5a48051932f1017a6e1bc9b18f854d0" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/b053fcd8912f06c30f932f5b8ec41c72de474695" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/cd98837db15f323463b8df07282ac723bd5c3fed" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/7c71a9522555ff137a9ca36b15d759ca04d84788" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/88fe2e3658726cb21ff2dcf9770bf672f9b9d31b" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-09-02T13:01:47Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - The vulnerable code is reached from local userspace through ALSA PCM character-device ioctls such as SNDRV_PCM_IOCTL_LINK, SNDRV_PCM_IOCTL_UNLINK, and SNDRV_PCM_IOCTL_DRAIN. It is not reachable by remote network packets or adjacent/physical protocols.\nAC:L - The bug is a race, but the attacker can control both sides by using multiple PCM file descriptors/threads to link streams, block in drain, and concurrently unlink. No condition outside attacker control is required once suitable PCM devices are accessible.\nPR:L - No kernel capability check gates the vulnerable ioctl path, but the attacker needs local access to open ALSA PCM device nodes. That corresponds to a basic unprivileged local user with device access, not real root/admin privileges.\nUI:N - Exploitation is driven entirely by the attacker's own ioctl calls on opened PCM file descriptors. No victim user action is required.\nS:U - The vulnerability is in the kernel ALSA subsystem and affects kernel resources under the same security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The documented failure is a panic, but the primitive is kernel wait-queue list corruption with an orphaned stack wait entry and cross-queue linkage under attacker-controlled timing. Under the higher-severity rule, this memory corruption is treated as potentially usable for kernel memory disclosure.\nI:H - The bug corrupts kernel wait-queue list pointers and can leave stale wait entries reachable by later wakeups. Although the observed path dereferences a NULL function pointer, this is kernel memory corruption plausibly usable for control-flow or privilege-impacting writes, so integrity is High.\nA:H - A subsequent wake_up can dereference a NULL/misinterpreted wait-queue function pointer and panic the kernel. This is a reliable high availability impact." } } }