CVE-2026-80716
High · 7.8CVSS
7.8
EPSS
0.1%
Published
Aug 28, 2026
CISA due date
—
Cloudanix analysis
A bug in how Linux handles sound device connections can let a local user crash the system or possibly gain higher privileges by manipulating audio stream links.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Use-after-free in ALSA PCM drain handling for linked streams: snd_pcm_drain parks an on-stack wait entry that is conditionally removed only on group membership match; unlink or signal/timeout paths leave the entry queued, so later wake_up walks a freed stack frame.
Why it matters to the business
Local attackers on affected Linux systems can trigger kernel memory corruption leading to crashes or potential privilege escalation; high-urgency patching required for any kernel using ALSA PCM linking.
How an attack unfolds
An attacker opens linked PCM streams, calls snd_pcm_drain on one while the other is active, then unlinks the streams (or causes group change) during the wait window; signal or timeout leaves the stack entry queued so a subsequent wake-up dereferences freed memory.
How to fix it
Upgrade to a Linux kernel containing the fix that wakes every group member under the group lock before membership change in snd_pcm_unlink; apply the ALSA PCM patch that ensures drain waiters are released while streams remain grouped.
How to confirm the fix worked
Verify the kernel source contains the commit titled 'ALSA: pcm: wake linked drain waiters on unlink'; confirm snd_pcm_unlink now acquires the group lock and wakes sleep queues before altering membership; test linked drain/unlink sequences under signal and timeout conditions.
Typical attack path
- Open and link two PCM streams via snd_pcm_link
- Issue snd_pcm_drain on one stream
- Trigger unlink or group membership change while the drain waiter is parked
- Cause the wait to end via signal or timeout instead of normal wake
- Trigger wake_up on the affected sleep queue to walk the freed entry
How to detect it
Inspect kernel logs for ALSA PCM unlink and drain operations around crash times; search for use-after-free reports in snd_pcm_runtime or wait_queue_entry structures; review audit logs for unprivileged processes calling snd_pcm_link and snd_pcm_unlink in rapid succession.
What your security team should do
- Patch all Linux kernels to a version containing the ALSA PCM unlink wake-up fix within the next 30 days
- Disable ALSA PCM linking for untrusted local users where kernel upgrade is delayed
- Monitor kernel update channels for backports to supported distributions
The record
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink snd_pcm_drain() on a linked stream parks an on-stack wait entry on the drained peer's runtime->sleep, and after schedule_timeout() removes it only if that peer is still found in the caller's group. If group membership changes during the wait and the sleep ends by signal or timeout (so autoremove_wake_function() does not run), finish_wait() is skipped and snd_pcm_drain() returns with the entry still queued on that stream's sleep list; a later wake_up() then walks a freed stack frame. This is reachable by unlinking either the drained or the draining stream. Unlike the close path (snd_pcm_drop() -> snd_pcm_post_stop()), snd_pcm_unlink() never wakes the sleep queues. Wake every group member under the group lock before the membership change, so a linked drainer is released and drops its entry while the streams are still grouped. The window was opened when snd_pcm_link_rwsem stopped being held across the wait and the removal became conditional on group membership (see Fixes). The later switch to finish_wait() kept that conditional removal, so the signal/timeout case remained.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|