CVE-2026-53242
ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams snd_pcm_drain() uses init_waitqueue_entry which does not clear entry.prev/next, and add_wait_queue with a conditional remove_wait_queue that is skipped when to_check is no longer in the group after concurrent UNLINK. The orphaned wait entry remains on the unlinked substream sleep queue. On the next drain iteration, add_wait_queue adds the entry to a new queue while still linked on the old one, corrupting both lists. A subsequent wake_up dereferences NULL at the func pointer (mapped from the spinlock at offset 0 of the misinterpreted wait_queue_head_t), causing a kernel panic. Replace init_waitqueue_entry/add_wait_queue/conditional remove_wait_queue with init_wait_entry/prepare_to_wait/ finish_wait. init_wait_entry clears prev/next via INIT_LIST_HEAD on each iteration and sets autoremove_wake_function which auto-removes the entry on wake-up. finish_wait safely handles both the already-removed and still-queued cases.
INFO
Published Date :
June 25, 2026, 9:16 a.m.
Last Modified :
July 7, 2026, 10:22 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the resolved version.
- Apply the patch for ALSA PCM wait queue fix.
- Ensure correct wait queue management.
- Restart affected systems if needed.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53242.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53242 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53242
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53242 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53242 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 07, 2026
Action Type Old Value New Value Added CWE CWE-476 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:-:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.12.78 up to (excluding) 6.12.94 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.18.19 up to (excluding) 6.18.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.253 up to (excluding) 5.10.259 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.167 up to (excluding) 6.1.176 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19.9 up to (excluding) 7.0 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.6.130 up to (excluding) 6.6.143 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 7.0.1 up to (excluding) 7.0.13 Added Reference Type kernel.org: https://git.kernel.org/stable/c/7c71a9522555ff137a9ca36b15d759ca04d84788 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/88fe2e3658726cb21ff2dcf9770bf672f9b9d31b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b053fcd8912f06c30f932f5b8ec41c72de474695 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/cac5bf3500ee6422cf64e0df0b5daeecfed42917 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/cd98837db15f323463b8df07282ac723bd5c3fed Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d68b621bb5a48051932f1017a6e1bc9b18f854d0 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d842f26a167e77a36f3ed333b9fa99d36ef99fe6 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 28, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '9baee36e8c5443411c4629afabafaff8a46a23fd', 'lessThan': 'cac5bf3500ee6422cf64e0df0b5daeecfed42917', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc71f888994569f87d5bee20b1ac6c9c1e3a7a79', 'lessThan': 'd842f26a167e77a36f3ed333b9fa99d36ef99fe6', 'versionType': 'git'}, {'status': 'affected', 'version': '629cf09464cf98670996ea5c191dc9743e6f3f00', 'lessThan': 'd68b621bb5a48051932f1017a6e1bc9b18f854d0', 'versionType': 'git'}, {'status': 'affected', 'version': 'ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432', 'lessThan': 'b053fcd8912f06c30f932f5b8ec41c72de474695', 'versionType': 'git'}, {'status': 'affected', 'version': '4a758e9a1f5ed722f83c4dd35f867fe811553bcb', 'lessThan': 'cd98837db15f323463b8df07282ac723bd5c3fed', 'versionType': 'git'}, {'status': 'affected', 'version': '9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6', 'lessThan': '7c71a9522555ff137a9ca36b15d759ca04d84788', 'versionType': 'git'}, {'status': 'affected', 'version': '9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6', 'lessThan': '88fe2e3658726cb21ff2dcf9770bf672f9b9d31b', 'versionType': 'git'}, {'status': 'affected', 'version': 'c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694', 'versionType': 'git'}, {'status': 'affected', 'version': '5.10.253', 'lessThan': '5.10.259', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.167', 'lessThan': '6.1.176', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.6.130', 'lessThan': '6.6.143', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.12.78', 'lessThan': '6.12.94', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.18.19', 'lessThan': '6.18.36', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.19.9', 'lessThan': '6.20', 'versionType': 'semver'}], 'programFiles': ['sound/core/pcm_native.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '7.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '7.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.94', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['sound/core/pcm_native.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams snd_pcm_drain() uses init_waitqueue_entry which does not clear entry.prev/next, and add_wait_queue with a conditional remove_wait_queue that is skipped when to_check is no longer in the group after concurrent UNLINK. The orphaned wait entry remains on the unlinked substream sleep queue. On the next drain iteration, add_wait_queue adds the entry to a new queue while still linked on the old one, corrupting both lists. A subsequent wake_up dereferences NULL at the func pointer (mapped from the spinlock at offset 0 of the misinterpreted wait_queue_head_t), causing a kernel panic. Replace init_waitqueue_entry/add_wait_queue/conditional remove_wait_queue with init_wait_entry/prepare_to_wait/ finish_wait. init_wait_entry clears prev/next via INIT_LIST_HEAD on each iteration and sets autoremove_wake_function which auto-removes the entry on wake-up. finish_wait safely handles both the already-removed and still-queued cases. Added Reference https://git.kernel.org/stable/c/7c71a9522555ff137a9ca36b15d759ca04d84788 Added Reference https://git.kernel.org/stable/c/88fe2e3658726cb21ff2dcf9770bf672f9b9d31b Added Reference https://git.kernel.org/stable/c/b053fcd8912f06c30f932f5b8ec41c72de474695 Added Reference https://git.kernel.org/stable/c/cac5bf3500ee6422cf64e0df0b5daeecfed42917 Added Reference https://git.kernel.org/stable/c/cd98837db15f323463b8df07282ac723bd5c3fed Added Reference https://git.kernel.org/stable/c/d68b621bb5a48051932f1017a6e1bc9b18f854d0 Added Reference https://git.kernel.org/stable/c/d842f26a167e77a36f3ed333b9fa99d36ef99fe6