CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink

Published Aug 28, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: wake linked drain waiters on unlink

sndpcmdrain() on a linked stream parks an on-stack wait entry on the drained peer's runtime->sleep, and after scheduletimeout() removes it only if that peer is still found in the caller's group. If group membership changes during the wait and the sleep ends by signal or timeout (so autoremovewakefunction() does not run), finishwait() is skipped and sndpcmdrain() returns with the entry still queued on that stream's sleep list; a later wakeup() then walks a freed stack frame. This is reachable by unlinking either the drained or the draining stream.

Unlike the close path (sndpcmdrop() -> sndpcmpoststop()), sndpcmunlink() never wakes the sleep queues. Wake every group member under the group lock before the membership change, so a linked drainer is released and drops its entry while the streams are still grouped.

The window was opened when sndpcmlinkrwsem stopped being held across the wait and the removal became conditional on group membership (see Fixes). The later switch to finishwait() kept that conditional removal, so the signal/timeout case remained.

Event History

Aug 28, 2026
CVE Published
via MITRE·06:53 AM
Data Sourced
via MITRE·06:53 AM
Description

Frequently Asked Questions

1

What conditions are required to trigger the use-after-free?

An ALSA PCM stream must be linked, with snd_pcm_drain() waiting on its peer. During that wait, either the drained or draining stream must be unlinked, and the wait must end by signal or timeout rather than by the normal wake path.

2

What happens after the affected drain call returns?

The drain operation can leave an on-stack wait entry queued on a stream sleep list. A later wake_up() on that list can then traverse the freed stack frame.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203