CVE-2026-53242
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams snd_pcm_drain() uses init_waitqueue_entry which does not clear entry.prev/next, and add_wait_queue with a conditional remove_wait_queue that is skipped when to_check is no longer in the group after concurrent UNLINK. The orphaned wait entry remains on the unlinked substream sleep queue. On the next drain iteration, add_wait_queue adds the entry to a new queue while still linked on the old one, corrupting both lists. A subsequent wake_up dereferences NULL at the func pointer (mapped from the spinlock at offset 0 of the misinterpreted wait_queue_head_t), causing a kernel panic. Replace init_waitqueue_entry/add_wait_queue/conditional remove_wait_queue with init_wait_entry/prepare_to_wait/ finish_wait. init_wait_entry clears prev/next via INIT_LIST_HEAD on each iteration and sets autoremove_wake_function which auto-removes the entry on wake-up. finish_wait safely handles both the already-removed and still-queued cases.
How to fix
- linux linux_kernel5.10.259, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0, 7.0.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 5.10.253 ≤ v < 5.10.259, 6.1.167 ≤ v < 6.1.176, 6.6.130 ≤ v < 6.6.143, 6.12.78 ≤ v < 6.12.94, 6.18.19 ≤ v < 6.18.36, 6.19.9 ≤ v < 7.0, 7.0.1 ≤ v < 7.0.13, 7.0, 7.1 | 5.10.259, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0, 7.0.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.