CVE-2026-53242 ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
A race condition in the Linux kernel ALSA PCM driver causes list corruption and kernel panic during stream draining, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53242?
CVE-2026-53242 is a high-severity vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
snd_pcm_drain() uses init_waitqueue_entry which does not clear entry.prev/next, and add_wait_queue with a conditional remove_wait_queue that is skipped when to_check is no longer in the group after concurrent UNLINK. The orphaned wait entry remains on the unlinked substream sleep queue. On the next drain iteration, add_wait_queue adds the entry to a new queue while still linked on the old one, corrupting both lists. A subsequent wake_up dereferences NULL at the func pointer (mapped from the spinlock at offset 0 of the misinterpreted wait_queue_head_t), causing a kernel panic.
Replace init_waitqueue_entry/add_wait_queue/conditional remove_wait_queue with init_wait_entry/prepare_to_wait/ finish_wait. init_wait_entry clears prev/next via INIT_LIST_HEAD on each iteration and sets autoremove_wake_function which auto-removes the entry on wake-up. finish_wait safely handles both the already-removed and still-queued cases.
Which versions are affected by CVE-2026-53242?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53242?
Apply the vendor's patch.
Is CVE-2026-53242 being exploited?
There is no known exploitation of CVE-2026-53242 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90866, BELL-CVE-2026-53242, DEBIAN-CVE-2026-53242, GHSA-2p59-xc6p-6w7c, ROOT-OS-DEBIAN-11-CVE-2026-53242, ROOT-OS-DEBIAN-12-CVE-2026-53242 and 2 more.