https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 06:55:35 +0000 https://vulnerability.circl.lu/vuln/cve-2026-80716 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: pcm: wake linked drain waiters on unlink</p> <p>snd_pcm_drain() on a linked stream parks an on-stack wait entry on the drained peer&#39;s runtime-&gt;sleep, and after schedule_timeout() removes it only if that peer is still found in the caller&#39;s group. If group membership changes during the wait and the sleep ends by signal or timeout (so autoremove_wake_function() does not run), finish_wait() is skipped and snd_pcm_drain() returns with the entry still queued on that stream&#39;s sleep list; a later wake_up() then walks a freed stack frame. This is reachable by unlinking either the drained or the draining stream.</p> <p>Unlike the close path (snd_pcm_drop() -&gt; snd_pcm_post_stop()), snd_pcm_unlink() never wakes the sleep queues. Wake every group member under the group lock before the membership change, so a linked drainer is released and drops its entry while the streams are still grouped.</p> <p>The window was opened when snd_pcm_link_rwsem stopped being held across the wait and the removal became conditional on group membership (see Fixes). The later switch to finish_wait() kept that conditional removal, so the signal/timeout case remained.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: pcm: wake linked drain waiters on unlink</p> <p>snd_pcm_drain() on a linked stream parks an on-stack wait entry on the drained peer&#39;s runtime-&gt;sleep, and after schedule_timeout() removes it only if that peer is still found in the caller&#39;s group. If group membership changes during the wait and the sleep ends by signal or timeout (so autoremove_wake_function() does not run), finish_wait() is skipped and snd_pcm_drain() returns with the entry still queued on that stream&#39;s sleep list; a later wake_up() then walks a freed stack frame. This is reachable by unlinking either the drained or the draining stream.</p> <p>Unlike the close path (snd_pcm_drop() -&gt; snd_pcm_post_stop()), snd_pcm_unlink() never wakes the sleep queues. Wake every group member under the group lock before the membership change, so a linked drainer is released and drops its entry while the streams are still grouped.</p> <p>The window was opened when snd_pcm_link_rwsem stopped being held across the wait and the removal became conditional on group membership (see Fixes). The later switch to finish_wait() kept that conditional removal, so the signal/timeout case remained.</p> https://vulnerability.circl.lu/vuln/cve-2026-80716