CVE-2026-53242

Analyzed Analyzed - Analysis Complete

Linux Kernel PCM Substream Wait Queue Corruption

Publication date: 2026-06-25

Last updated on: 2026-07-07

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams snd_pcm_drain() uses init_waitqueue_entry which does not clear entry.prev/next, and add_wait_queue with a conditional remove_wait_queue that is skipped when to_check is no longer in the group after concurrent UNLINK. The orphaned wait entry remains on the unlinked substream sleep queue. On the next drain iteration, add_wait_queue adds the entry to a new queue while still linked on the old one, corrupting both lists. A subsequent wake_up dereferences NULL at the func pointer (mapped from the spinlock at offset 0 of the misinterpreted wait_queue_head_t), causing a kernel panic. Replace init_waitqueue_entry/add_wait_queue/conditional remove_wait_queue with init_wait_entry/prepare_to_wait/ finish_wait. init_wait_entry clears prev/next via INIT_LIST_HEAD on each iteration and sets autoremove_wake_function which auto-removes the entry on wake-up. finish_wait safely handles both the already-removed and still-queued cases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-07

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53242

EUVD

EUVD-2026-39193

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.0
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.12.78 (inc) to 6.12.94 (exc)
linux	linux_kernel	From 6.18.19 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 5.10.253 (inc) to 5.10.259 (exc)
linux	linux_kernel	From 6.1.167 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.19.9 (inc) to 7.0 (exc)
linux	linux_kernel	From 6.6.130 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 7.0.1 (inc) to 7.0.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's ALSA PCM subsystem, specifically in the snd_pcm_drain() function handling linked streams.

The issue arises because snd_pcm_drain() uses init_waitqueue_entry which does not clear the entry's prev/next pointers, combined with add_wait_queue and a conditional remove_wait_queue that can be skipped during concurrent unlinking of streams.

As a result, an orphaned wait entry remains on an unlinked substream's sleep queue. On the next drain iteration, add_wait_queue adds this entry to a new queue while it is still linked to the old one, corrupting both wait queues.

This corruption leads to a subsequent wake_up call dereferencing a NULL function pointer (misinterpreted from a spinlock), which causes a kernel panic.

The fix replaces the problematic functions with safer alternatives that clear the prev/next pointers properly and auto-remove wait entries on wake-up, preventing the queue corruption and kernel panic.

Impact Analysis

This vulnerability can cause a kernel panic in the Linux system when using ALSA PCM linked streams, leading to a system crash.

A kernel panic results in an immediate system halt, which can cause loss of unsaved data, service downtime, and potential disruption of critical operations.

If exploited or triggered unintentionally, it could affect system stability and availability, especially in environments relying on audio processing or linked PCM streams.

Mitigation Strategies

This vulnerability in the Linux kernel ALSA PCM subsystem causes kernel panic due to wait queue list corruption in snd_pcm_drain() on linked streams.

To mitigate this vulnerability, update your Linux kernel to a version where this issue is fixed. The fix replaces the use of init_waitqueue_entry/add_wait_queue/conditional remove_wait_queue with init_wait_entry/prepare_to_wait/finish_wait, which properly manages wait queue entries and prevents list corruption.

Hi! I’m here to help you understand CVE-2026-53242. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70