{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-89980",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-89980"
  ],
  "published": "2026-09-16T10:32:03Z",
  "summary": "ALSA: harmony: initialize locks before requesting IRQ",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: harmony: initialize locks before requesting IRQ\n\nsnd_harmony_create() registers the IRQ before initializing h->lock and\nh->mixer_lock. A pending interrupt can invoke the handler while these\nlocks are uninitialized.\n\nInitialize both locks before requesting the IRQ so the handler always\nsees valid lock state.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.188",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89980"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9af6c9203583655cb7ed45e52e14101652b37547"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f86ff9238b0c8284909e073a681a60708b9f36ab"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/7dc239edb6d58e01c9ec868565cc03e7adf91747"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9347588bbd6ad43a85e17046d9c117a41453c52a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/89992bda7dfbba7ded2ba4185730453c57fa65bc"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cd209eb3136e002becbda232e399fa31a2276436"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/33abb7491e89285a41565670945293dda841afc4"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-09-16T14:40:32Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 8.4,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The bug is reached only from snd_harmony_probe() \u2192 snd_harmony_create() \u2192 request_irq() \u2192 snd_harmony_interrupt() on onboard HP PA-RISC LASI/ASP Harmony audio, which enumerates at boot or module bind. There is no network, Bluetooth, or USB packet path into this GSC chip.\nAC:L - snd_harmony_create() calls request_irq() before spin_lock_init() and before pcm_init()'s harmony_disable_interrupts(). Firmware leftover DSTATUS_IE plus pending PN/RN lets gsc_asic_unmask_irq() deliver snd_harmony_interrupt() immediately against uninitialized h->lock, without an attacker-uncontrollable race.\nPR:N - snd_harmony_create() performs no capability or authentication checks before request_irq(). On GSC/LASI PA-RISC workstations and servers with Harmony, kernel/udev enumeration runs the vulnerable probe automatically without an OS account or user-namespace privilege.\nUI:N - No victim action is required. A pending Harmony interrupt during driver probe at boot or module autoload invokes the uninitialized-lock IRQ path without anyone opening ALSA PCM or control nodes.\nS:U - Impact is uninitialized spinlock use and DMA next-address programming inside the host kernel Harmony driver. This does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - snd_harmony_interrupt() takes uninitialized h->lock in hard-IRQ context and, with psubs/csubs still NULL, programs HARMONY_PNXTADD from zeroed sdma so the chip DMAs from physical address 0. That undefined lock/DMA behavior can disclose kernel memory rather than a small bounded leak.\nI:H - On SMP PA-RISC (defconfig), probe can spin_lock_init() h->lock while the IRQ handler still holds the zeroed lock, and the handler writes HARMONY_RNXTADD/PNXTADD (including 0) in that window. That lock-state corruption and invalid DMA programming are write/control-flow primitives, not a pure crash.\nA:H - Taking uninitialized h->lock in snd_harmony_interrupt() during probe hits DEBUG_SPINLOCK bad-magic BUG, lockdep non-static-key failure, oops/panic, or a hung IRQ/DMA path on affected PA-RISC machines, fully denying availability."
    }
  }
}