CVE-2026-89979
HighCVSS 7.8Summary
A race condition exists in the Linux kernel between non-atomic ALSA PCM operations (hw_params, hw_free, prepare) and the atomic trigger-start operation. While one thread performs a non-atomic operation, another thread can trigger the PCM start, leading to state inconsistencies and ODEBUG warnings reported by syzkaller. The fix prevents trigger-start during non-atomic operations by checking the runtime->buffer_accessing value.
Risk Assessment
The vulnerability can cause instability in the sound subsystem, kernel warnings, and potential errors in applications using ALSA PCM. In multithreaded environments or with shared access to audio devices, it may lead to unpredictable system behavior.
Recommendation
Update the Linux kernel to a version containing the fix for CVE-2026-89979. If an update is not possible, restrict concurrent application access to ALSA PCM devices.
Other vulnerabilities in Linux kernel
See all- CVE-2026-98163Unknown
A vulnerability was found in the Linux kernel's cgroup subsystem, involving iteration over dying tasks with a zero reference count. This leads to a race condition where the iterator may access a task after it has been freed, resulting in a use-after-free.
- CVE-2026-98162Unknown
In the Linux kernel, the smb2_tree_connect() function of the SMB server (ksmbd) leaks a tree connection. When ksmbd_iov_pin_rsp() fails, the newly created tree connection is not disconnected, leading to a resource leak.
- CVE-2026-98161Unknown
In the Linux kernel, the nvdimm (pmem) pmem_submit_bio() function records a REQ_PREFLUSH error but continues to copy bio data and can later overwrite the error with a successful REQ_FUA flush. This allows data writes to run after a failed preflush and can complete the bio successfully despite the failed ordering barrier.
- CVE-2026-98160Unknown
In the Linux kernel, the staging rtl8723bs driver's rtw_sdio_if1_init() function frees padapter->HalData with kfree(), even though it was allocated via vzalloc(). Using kfree() to release a vmalloc-backed buffer can lead to memory corruption.
- CVE-2026-100079Unknown
In the Linux kernel, the USB Type-C (ucsi) subsystem's ucsi_register() creates per-instance debugfs entries, but ucsi_unregister() keeps them until ucsi_destroy(). Drivers like ucsi_glink that unregister/register the same UCSI instance across remoteproc restart then try to create an already existing debugfs directory.
- CVE-2026-100078Unknown
In the Linux kernel, the iwlwifi (mei) driver's iwl_mei_write_cyclic_buf() function receives an incorrect first argument — the q_head pointer is passed instead of cldev. The bug has been fixed.
- CVE-2026-100077Unknown
In the Linux kernel, the drm/msm driver does not safely retire a hung submit before GPU recovery completes. Retiring the submit triggers BO free, which can result in GPU pagefaults since the GPU may be actively accessing those BOs.
- CVE-2026-100074Unknown
In the Linux kernel, a bug was fixed where the BPF_REFCOUNT field was not marked as unique, although it should be. The fix addresses this oversight.
- CVE-2026-100073Unknown
In the Linux kernel, a bug in the ext4 filesystem related to transaction overflow during writeback was fixed. A previous fix was too eager in reducing reserved transaction credits, leading to insufficient reservation in some corner cases. The fix uses ext4_meta_trans_blocks() for a correct upper bound estimate.
- CVE-2026-100072Unknown
In the Linux kernel, a problem in the ACPI subsystem was fixed where the use of acpi_get_first_physical_node() in acpi_platform_fill_resource() and acpi_create_platform_device() was unsafe because the returned device could be freed at any time. The fix replaces it with acpi_bus_get_primary_device() and adjusts the code to call it only once.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix race between non-atomic ops and trigger-start We protect the races of the concurrent state transitions between atomic PCM ops, but the checks between the non-atomic ops (hw_params, hw_free and prepare) and the atomic ops aren't perfect; there is a check of the conflicting PCM state at the beginning of hw_params & co, but the atomic PCM ops can be still issued during the non-atomic PCM operations. An example such scenario is that a thread A re-issues the PREPARE or HW_PARAMS for the already prepared stream, while another thread B triggers the PCM start in the middle of the prepare operation. Although this usually doesn't lead to much serious issues, it can give some inconsistency as reported by syzkaller (such as ODEBUG warning). There are various atomic PCM ops, and basically the only problem is the PCM start as it operates from the PREPARED state. Other trigger commands (stop, etc) are for the running or the other special state, hence they are filtered as pre-condition. This patch is for preventing the PCM trigger-start during the non- atomic operations in order to address the problems above. Fortunately, the hw_params, hw_free and prepare operations call snd_pcm_buffer_access_lock(), and this can be used for checking the concurrent operations at the PCM trigger -- which sets the runtime->buffer_accessing to a negative (if possible), so the PCM trigger just needs to check the runtime->buffer_accessing value; if it's negative, it means the concurrent non-atomic PCM ops is running.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS