{"id":"CVE-2026-53242","summary":"ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams\n\nsnd_pcm_drain() uses init_waitqueue_entry which does not clear\nentry.prev/next, and add_wait_queue with a conditional\nremove_wait_queue that is skipped when to_check is no longer\nin the group after concurrent UNLINK.  The orphaned wait entry\nremains on the unlinked substream sleep queue.  On the next\ndrain iteration, add_wait_queue adds the entry to a new queue\nwhile still linked on the old one, corrupting both lists.  A\nsubsequent wake_up dereferences NULL at the func pointer\n(mapped from the spinlock at offset 0 of the misinterpreted\nwait_queue_head_t), causing a kernel panic.\n\nReplace init_waitqueue_entry/add_wait_queue/conditional\nremove_wait_queue with init_wait_entry/prepare_to_wait/\nfinish_wait.  init_wait_entry clears prev/next via\nINIT_LIST_HEAD on each iteration and sets\nautoremove_wake_function which auto-removes the entry on\nwake-up.  finish_wait safely handles both the already-removed\nand still-queued cases.","modified":"2026-10-28T02:30:41.492703463Z","published":"2026-06-25T08:39:37.129Z","related":["SUSE-SU-2026:23066-1","SUSE-SU-2026:23068-1","SUSE-SU-2026:23193-1","SUSE-SU-2026:23194-1","SUSE-SU-2026:23221-1","SUSE-SU-2026:23231-1","SUSE-SU-2026:23237-1","SUSE-SU-2026:23241-1","SUSE-SU-2026:23244-1","SUSE-SU-2026:3130-1","SUSE-SU-2026:3166-1","SUSE-SU-2026:3594-1","openSUSE-SU-2026:21555-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53242.json"},"references":[{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"},{"type":"WEB","url":"https://git.kernel.org/stable/c/06eca2235a3fd281dddf25b0a97772b25b5bb573"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7c71a9522555ff137a9ca36b15d759ca04d84788"},{"type":"WEB","url":"https://git.kernel.org/stable/c/88fe2e3658726cb21ff2dcf9770bf672f9b9d31b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b053fcd8912f06c30f932f5b8ec41c72de474695"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cac5bf3500ee6422cf64e0df0b5daeecfed42917"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cd98837db15f323463b8df07282ac723bd5c3fed"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d68b621bb5a48051932f1017a6e1bc9b18f854d0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d842f26a167e77a36f3ed333b9fa99d36ef99fe6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53242.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53242"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"9baee36e8c5443411c4629afabafaff8a46a23fd"},{"fixed":"cac5bf3500ee6422cf64e0df0b5daeecfed42917"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f2cb2e0d27fb925c73a78f0ce7d6dbf68d3747c1"},{"fixed":"06eca2235a3fd281dddf25b0a97772b25b5bb573"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"fc71f888994569f87d5bee20b1ac6c9c1e3a7a79"},{"fixed":"d842f26a167e77a36f3ed333b9fa99d36ef99fe6"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"629cf09464cf98670996ea5c191dc9743e6f3f00"},{"fixed":"d68b621bb5a48051932f1017a6e1bc9b18f854d0"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432"},{"fixed":"b053fcd8912f06c30f932f5b8ec41c72de474695"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4a758e9a1f5ed722f83c4dd35f867fe811553bcb"},{"fixed":"cd98837db15f323463b8df07282ac723bd5c3fed"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6"},{"fixed":"7c71a9522555ff137a9ca36b15d759ca04d84788"},{"fixed":"88fe2e3658726cb21ff2dcf9770bf672f9b9d31b"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.10.253"},{"fixed":"5.10.259"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.1.167"},{"fixed":"6.1.176"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.6.130"},{"fixed":"6.6.143"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.12.78"},{"fixed":"6.12.94"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.18.19"},{"fixed":"6.18.36"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.19.9"},{"fixed":"6.20"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694"}]}],"versions":["v5.10.258","v5.10.257","v5.10.256","v5.10.255","v5.10.254","v5.10.253","v6.1.175","v6.1.174","v6.1.173","v6.1.172","v6.1.171","v6.1.170","v6.1.169","v6.1.168","v6.1.167","v6.6.142","v6.6.141","v6.6.140","v6.6.139","v6.6.138","v6.6.137","v6.6.136","v6.6.135","v6.6.134","v6.6.133","v6.6.132","v6.6.131","v6.6.130","v6.12.93","v6.12.92","v6.12.91","v6.12.90","v6.12.89","v6.12.88","v6.12.87","v6.12.86","v6.12.85","v6.12.84","v6.12.83","v6.12.82","v6.12.81","v6.12.80","v6.12.79","v6.12.78","v6.18.35","v6.18.34","v6.18.33","v6.18.32","v6.18.31","v6.18.30","v6.18.29","v6.18.28","v6.18.27","v6.18.26","v6.18.25","v6.18.24","v6.18.23","v6.18.22","v6.18.21","v6.18.20","v6.18.19","v6.19.14","v6.19.13","v6.19.12","v6.19.11","v6.19.10","v6.19.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53242.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.259"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"6.1.176"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.143"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.94"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.36"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.13"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53242.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}