{"id":"CVE-2026-53242","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams\n\nsnd_pcm_drain() uses init_waitqueue_entry which does not clear\nentry.prev/next, and add_…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams\n\nsnd_pcm_drain() uses init_waitqueue_entry which does not clear\nentry.prev/next, and add_…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-476"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.10.253, < 5.10.259","linux_kernel >= 6.1.167, < 6.1.176","linux_kernel >= 6.6.130, < 6.6.143","linux_kernel >= 6.12.78, < 6.12.94","linux_kernel >= 6.18.19, < 6.18.36","linux_kernel >= 6.19.9, < 7.0","linux_kernel >= 7.0.1, < 7.0.13","linux_kernel = 7.0","linux_kernel = 7.1"],"patched":["linux_kernel 7.0.13"],"published":"2026-06-25","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:20:06.347","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53242","references":[{"url":"https://git.kernel.org/stable/c/06eca2235a3fd281dddf25b0a97772b25b5bb573","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c71a9522555ff137a9ca36b15d759ca04d84788","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/88fe2e3658726cb21ff2dcf9770bf672f9b9d31b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b053fcd8912f06c30f932f5b8ec41c72de474695","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cac5bf3500ee6422cf64e0df0b5daeecfed42917","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cd98837db15f323463b8df07282ac723bd5c3fed","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d68b621bb5a48051932f1017a6e1bc9b18f854d0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d842f26a167e77a36f3ed333b9fa99d36ef99fe6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00129,"epssPercentile":0.02267,"ingestedAt":"2026-10-15T03:30:12.909Z","slug":"CVE-2026-53242","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams\n\nsnd_pcm_drain() uses init_waitqueue_entry which does not clear\nentry.prev/next, and add_wait_queue with a conditional\nremove_wait_queue that is skipped when to_check is no longer\nin the group after concurrent UNLINK.  The orphaned wait entry\nremains on the unlinked substream sleep queue.  On the next\ndrain iteration, add_wait_queue adds the entry to a new queue\nwhile still linked on the old one, corrupting both lists.  A\nsubsequent wake_up dereferences NULL at the func pointer\n(mapped from the spinlock at offset 0 of the misinterpreted\nwait_queue_head_t), causing a kernel panic.\n\nReplace init_waitqueue_entry/add_wait_queue/conditional\nremove_wait_queue with init_wait_entry/prepare_to_wait/\nfinish_wait.  init_wait_entry clears prev/next via\nINIT_LIST_HEAD on each iteration and sets\nautoremove_wake_function which auto-removes the entry on\nwake-up.  finish_wait safely handles both the already-removed\nand still-queued cases.\n\n## Affected\n\n- `linux_kernel >= 5.10.253, < 5.10.259`\n- `linux_kernel >= 6.1.167, < 6.1.176`\n- `linux_kernel >= 6.6.130, < 6.6.143`\n- `linux_kernel >= 6.12.78, < 6.12.94`\n- `linux_kernel >= 6.18.19, < 6.18.36`\n- `linux_kernel >= 6.19.9, < 7.0`\n- `linux_kernel >= 7.0.1, < 7.0.13`\n- `linux_kernel = 7.0`\n- `linux_kernel = 7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.13`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}