---
id: CVE-2026-23191
title: 'ALSA: aloop: Fix racy access at PCM trigger'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: aloop: Fix racy access at PCM trigger

  The PCM trigger callback of aloop driver tries to check the PCM state
  and stop the stream of the tied substream in the corr…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b1c73fc8e697eb73e23603e465e9af2711ed4183 <
    f57467114f40c5aacebbea96fb4ff9e5cd2b7f18
  - >-
    Linux >= b1c73fc8e697eb73e23603e465e9af2711ed4183 <
    c99be0d5af02adebe9cb6f9869d20397fa9935a3
  - >-
    Linux >= b1c73fc8e697eb73e23603e465e9af2711ed4183 <
    f3ce8be893726899e3053cf8059ecc95d8410359
  - >-
    Linux >= b1c73fc8e697eb73e23603e465e9af2711ed4183 <
    0e6245b2424d126ac90018142d09f0707e12998b
  - >-
    Linux >= b1c73fc8e697eb73e23603e465e9af2711ed4183 <
    bad15420050db1803767e58756114800cce91ea4
  - >-
    Linux >= b1c73fc8e697eb73e23603e465e9af2711ed4183 <
    5727ccf9d19ca414cb76d9b647883822e2789c2e
  - >-
    Linux >= b1c73fc8e697eb73e23603e465e9af2711ed4183 <
    826af7fa62e347464b1b4e0ba2fe19a92438084f
  - Linux 2.6.37
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-16T20:20:28.206628Z'
published: '2026-02-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T11:58:11.809Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23191'
references:
  - url: 'https://git.kernel.org/stable/c/f57467114f40c5aacebbea96fb4ff9e5cd2b7f18'
  - url: 'https://git.kernel.org/stable/c/c99be0d5af02adebe9cb6f9869d20397fa9935a3'
  - url: 'https://git.kernel.org/stable/c/f3ce8be893726899e3053cf8059ecc95d8410359'
  - url: 'https://git.kernel.org/stable/c/0e6245b2424d126ac90018142d09f0707e12998b'
  - url: 'https://git.kernel.org/stable/c/bad15420050db1803767e58756114800cce91ea4'
  - url: 'https://git.kernel.org/stable/c/5727ccf9d19ca414cb76d9b647883822e2789c2e'
  - url: 'https://git.kernel.org/stable/c/826af7fa62e347464b1b4e0ba2fe19a92438084f'
tags:
  - cve.org
epss: 0.00119
epssPercentile: 0.01594
ingestedAt: '2026-09-14T15:23:07.459Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: aloop: Fix racy access at PCM trigger

The PCM trigger callback of aloop driver tries to check the PCM state
and stop the stream of the tied substream in the corresponding cable.
Since both check and stop operations are performed outside the cable
lock, this may result in UAF when a program attempts to trigger
frequently while opening/closing the tied stream, as spotted by
fuzzers.

For addressing the UAF, this patch changes two things:
- It covers the most of code in loopback_check_format() with
  cable->lock spinlock, and add the proper NULL checks.  This avoids
  already some racy accesses.
- In addition, now we try to check the state of the capture PCM stream
  that may be stopped in this function, which was the major pain point
  leading to UAF.

## Affected

- `Linux >= b1c73fc8e697eb73e23603e465e9af2711ed4183 < f57467114f40c5aacebbea96fb4ff9e5cd2b7f18`
- `Linux >= b1c73fc8e697eb73e23603e465e9af2711ed4183 < c99be0d5af02adebe9cb6f9869d20397fa9935a3`
- `Linux >= b1c73fc8e697eb73e23603e465e9af2711ed4183 < f3ce8be893726899e3053cf8059ecc95d8410359`
- `Linux >= b1c73fc8e697eb73e23603e465e9af2711ed4183 < 0e6245b2424d126ac90018142d09f0707e12998b`
- `Linux >= b1c73fc8e697eb73e23603e465e9af2711ed4183 < bad15420050db1803767e58756114800cce91ea4`
- `Linux >= b1c73fc8e697eb73e23603e465e9af2711ed4183 < 5727ccf9d19ca414cb76d9b647883822e2789c2e`
- `Linux >= b1c73fc8e697eb73e23603e465e9af2711ed4183 < 826af7fa62e347464b1b4e0ba2fe19a92438084f`
- `Linux 2.6.37`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.