01 Record

CVE-2026-53242

ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.10% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 0.8% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-19.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-06-25 08:39Z4 MO AGO

Last updated

2026-10-19 19:57Z10 DAYS AGO

Reserved

2026-06-09

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')Class
CWE-476NULL Pointer DereferenceBase
CWE-824Access of Uninitialized PointerBase

Data version

5.2

Document digest

6b8b5b5c62efe814a5c446ec51ca7b169651c4da57931620e7f52052ee884a21

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux9baee36e8c5443411c4629afabafaff8a46a23fd to < cac5bf3500ee6422cf64e0df0b5daeecfed42917, f2cb2e0d27fb925c73a78f0ce7d6dbf68d3747c1 to < 06eca2235a3fd281dddf25b0a97772b25b5bb573, fc71f888994569f87d5bee20b1ac6c9c1e3a7a79 to < d842f26a167e77a36f3ed333b9fa99d36ef99fe6, 629cf09464cf98670996ea5c191dc9743e6f3f00 to < d68b621bb5a48051932f1017a6e1bc9b18f854d0, ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432 to < b053fcd8912f06c30f932f5b8ec41c72de474695, 4a758e9a1f5ed722f83c4dd35f867fe811553bcb to < cd98837db15f323463b8df07282ac723bd5c3fed, 9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 to < 7c71a9522555ff137a9ca36b15d759ca04d84788, 9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 to < 88fe2e3658726cb21ff2dcf9770bf672f9b9d31b, c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694, 5.10.253 to < 5.10.259, 6.1.167 to < 6.1.176, 6.6.130 to < 6.6.143, 6.12.78 to < 6.12.94, 6.18.19 to < 6.18.36, 6.19.9 to < 6.20, 7.0—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/cac5bf3500ee6422cf64e0df0b5daeecfed42917
git.kernel.orghttps://git.kernel.org/stable/c/06eca2235a3fd281dddf25b0a97772b25b5bb573
git.kernel.orghttps://git.kernel.org/stable/c/d842f26a167e77a36f3ed333b9fa99d36ef99fe6
git.kernel.orghttps://git.kernel.org/stable/c/d68b621bb5a48051932f1017a6e1bc9b18f854d0
git.kernel.orghttps://git.kernel.org/stable/c/b053fcd8912f06c30f932f5b8ec41c72de474695
git.kernel.orghttps://git.kernel.org/stable/c/cd98837db15f323463b8df07282ac723bd5c3fed
git.kernel.orghttps://git.kernel.org/stable/c/7c71a9522555ff137a9ca36b15d759ca04d84788
git.kernel.orghttps://git.kernel.org/stable/c/88fe2e3658726cb21ff2dcf9770bf672f9b9d31b
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-784472.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.176-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.94-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.0.13-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.