CVE-2026-80628

Received Received - Intake

Race Condition in Linux Kernel ALSA OSS Sequencer

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Serialize readq reset state with q->lock snd_seq_oss_readq_clear() resets qlen, head, and tail without q->lock even though the normal reader and producer paths serialize the same ring state under that spinlock. A reset can therefore race snd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and leave stale records in the queue, drop freshly queued ones, or report the wrong readiness after wakeup. KCSAN reports a data race between snd_seq_oss_readq_clear() and snd_seq_oss_readq_free(). Take q->lock while clearing the ring and resetting input_time. Factor the enqueue logic into a caller-locked helper so snd_seq_oss_readq_put_timestamp() updates its suppression state under the same lock instead of racing the reset path. The buggy scenario involves two paths, with each column showing the order within that path: reset path: locked readq updater: 1. snd_seq_oss_reset() or 1. A reader or callback producer release reaches takes q->lock on the same queue. snd_seq_oss_readq_clear(). 2. snd_seq_oss_readq_clear() 2. The updater tests or modifies resets qlen, head, tail, qlen, head, and tail. and input_time. 3. snd_seq_oss_readq_clear() 3. The updater completes its wakes sleepers on read-modify-write sequence. q->midi_sleep. 4. Without q->lock, the reset 4. The resulting ring state drives can overlap the locked later reads and readiness. update. KCSAN reports: BUG: KCSAN: data-race in snd_seq_oss_readq_clear / snd_seq_oss_readq_free write to 0xffff8881069fe608 of 4 bytes by task 120516 on cpu 0: snd_seq_oss_readq_free+0x6c/0x80 snd_seq_oss_read+0xcb/0x250 odev_read+0x38/0x60 vfs_read+0xff/0x600 ksys_read+0xb4/0x140 __x64_sys_read+0x46/0x60 do_syscall_64+0xbb/0x2f0 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff8881069fe608 of 4 bytes by task 120517 on cpu 1: snd_seq_oss_readq_clear+0x1f/0x90 snd_seq_oss_reset+0xa7/0xf0 snd_seq_oss_ioctl+0x6f6/0x7e0 odev_ioctl+0x56/0xc0 __x64_sys_ioctl+0xd1/0x120 do_syscall_64+0xbb/0x2f0 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00000001 -> 0x00000000

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-18

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80628

EUVD

EUVD-2026-67504

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a data race vulnerability in the Linux kernel's ALSA sequencer OSS emulation. It occurs when the snd_seq_oss_readq_clear() function resets queue state without proper locking, allowing race conditions with other operations like snd_seq_oss_readq_free() or snd_seq_oss_readq_put_event(). This can corrupt the queue, drop events, or report incorrect readiness.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA sequencer OSS emulation subsystem. Detection requires checking the kernel version and whether the affected code paths are present. Use uname -a to check your kernel version and grep for the vulnerable functions in the kernel source or running kernel modules.

Impact Analysis

An attacker could exploit this to cause system instability, crashes, or unexpected behavior in audio processing. It may lead to audio glitches, application hangs, or privilege escalation if combined with other exploits. Systems using ALSA OSS emulation are affected.

Compliance Impact

This vulnerability is a data race in the Linux kernel's ALSA sequencer OSS emulation, which could lead to memory corruption or incorrect state handling. While not directly impacting GDPR or HIPAA compliance, such kernel-level vulnerabilities could potentially affect system stability or data integrity if exploited, indirectly influencing compliance by compromising secure data processing environments.

Mitigation Strategies

Apply the latest kernel security updates from your Linux distribution to patch the ALSA sequencer OSS emulation vulnerability. If immediate patching is not possible, consider disabling the OSS sequencer module (snd-seq-oss) if not required, or restrict access to /dev/sequencer and related devices.

Hi! I’m here to help you understand CVE-2026-80628. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70