CVE-2026-53242: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-25 · updated 2026-10-19
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams snd_pcm_drain() uses init_waitqueue_entry which does not clear entry.prev/next, and add_wait_queue with a conditional remove_wait_queue that is skipped when to_check is no longer in the group after concurrent UNLINK. The orphaned wait entry remains on the unlinked substream sleep queue. On the next drain iteration, add_wait_queue adds the entry to a new queue while still linked on the old one, corrupting both lists. A subsequent wake_up dereferences NULL at the func pointer (mapped from the spinlock at offset 0 of the misinterpreted wait_queue_head_t), causing a kernel panic. Replace init_waitqueue_entry/add_wait_queue/conditional remove_wait_queue with init_wait_entry/prepare_to_wait/ finish_wait. init_wait_entry clears prev/next via INIT_LIST_HEAD on each iteration and sets autoremove_wake_function which auto-removes the entry on wake-up. finish_wait safely handles both the already-removed and still-queued cases.

Affected products

Linux kernel: from 5.10.253 before 5.10.259; from 6.1.167 before 6.1.176; from 6.6.130 before 6.6.143; from 6.12.78 before 6.12.94; from 6.18.19 before 6.18.36; from 6.19.9 before 7.0 — fixed in 5.10.259, 6.1.176, 6.12.94, 6.18.36, 6.6.143, 7.0

How to fix

Upgrade to a fixed version: Linux kernel 5.10.259, 6.1.176, 6.12.94, 6.18.36. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-53242 or the next vulnerability affects your stack