Linux Kernel ALSA sound subsystem Null Pointer Dereference Allows Kernel Panic

Status: UPDATED  |  Advisory ID: CVE-2026-53242

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

snd_pcm_drain() uses init_waitqueue_entry which does not clear

entry.prev/next, and add_wait_queue with a conditional

remove_wait_queue that is skipped when to_check is no longer

in the group after concurrent UNLINK. The orphaned wait entry

remains on the unlinked substream sleep queue. On the next

drain iteration, add_wait_queue adds the entry to a new queue

while still linked on the old one, corrupting both lists. A

subsequent wake_up dereferences NULL at the func pointer

(mapped from the spinlock at offset 0 of the misinterpreted

wait_queue_head_t), causing a kernel panic.

Replace init_waitqueue_entry/add_wait_queue/conditional

remove_wait_queue with init_wait_entry/prepare_to_wait/

finish_wait. init_wait_entry clears prev/next via

INIT_LIST_HEAD on each iteration and sets

autoremove_wake_function which auto-removes the entry on

wake-up. finish_wait safely handles both the already-removed

and still-queued cases. (NVD)

What to Do

Monitor Linux's and Siemens's web pages for any future patch releases.

References