PT-2026-52337 · Linux · Linux

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-53242

NVD

In the Linux kernel, the following vulnerability has been resolved:

ALSA: PCM: Fix wait queue list corruption in snd pcm drain() on linked streams

snd pcm drain() uses init waitqueue entry which does not clear entry.prev/next, and add wait queue with a conditional remove wait queue that is skipped when to check is no longer in the group after concurrent UNLINK. The orphaned wait entry remains on the unlinked substream sleep queue. On the next drain iteration, add wait queue adds the entry to a new queue while still linked on the old one, corrupting both lists. A subsequent wake up dereferences NULL at the func pointer (mapped from the spinlock at offset 0 of the misinterpreted wait queue head t), causing a kernel panic.

Replace init waitqueue entry/add wait queue/conditional remove wait queue with init wait entry/prepare to wait/ finish wait. init wait entry clears prev/next via INIT LIST HEAD on each iteration and sets autoremove wake function which auto-removes the entry on wake-up. finish wait safely handles both the already-removed and still-queued cases.

Related Identifiers

CVE-2026-53242

Affected Products

Linux

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-53242 · Security Note
• https://git.kernel.org/stable/c/d842f26a167e77a36f3ed333b9fa99d36ef99fe6 · Note
• https://git.kernel.org/stable/c/cd98837db15f323463b8df07282ac723bd5c3fed · Note
• https://git.kernel.org/stable/c/d68b621bb5a48051932f1017a6e1bc9b18f854d0 · Note
• https://git.kernel.org/stable/c/7c71a9522555ff137a9ca36b15d759ca04d84788 · Note
• https://git.kernel.org/stable/c/88fe2e3658726cb21ff2dcf9770bf672f9b9d31b · Note
• https://git.kernel.org/stable/c/cac5bf3500ee6422cf64e0df0b5daeecfed42917 · Note
• https://git.kernel.org/stable/c/b053fcd8912f06c30f932f5b8ec41c72de474695 · Note