REDHAT-BUG-2481980: Medium severity Linux ALSA aloop vulnerability
In the Linux kernel, the following vulnerability has been resolved:
ALSA: aloop: Fix peer runtime UAF during format-change stop
loopbackcheckformat() may stop the capture side when playback starts with parameters that no longer match a running capture stream. Commit 826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved the peer lookup under cable->lock, but the actual sndpcmstop() still runs after dropping that lock.
A concurrent close can clear the capture entry from cable->streams[] and detach or free its runtime while the playback trigger path still holds a stale peer substream pointer.
Keep a per-cable count of in-flight peer stops before dropping cable->lock, and make freecable() wait for those stops before detaching the runtime. This preserves the existing behavior while making the peer runtime lifetime explicit.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2481980?
The severity of REDHAT-BUG-2481980 is rated as medium with a score of 4.
How do I fix REDHAT-BUG-2481980?
To fix REDHAT-BUG-2481980, ensure that you update your Linux ALSA packages to the latest version that addresses this vulnerability.
What components are affected by REDHAT-BUG-2481980?
REDHAT-BUG-2481980 affects the Linux ALSA aloop component of the Linux kernel.
What does REDHAT-BUG-2481980 entail?
REDHAT-BUG-2481980 involves a use-after-free (UAF) vulnerability in the ALSA aloop that can disrupt audio format-change operations.
When was REDHAT-BUG-2481980 published?
REDHAT-BUG-2481980 was published on May 27, 2026.