---
id: CVE-2026-53242
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

  snd_pcm_drain() uses init_waitqueue_entry which does not clear
  entry.prev/next, and add_…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

  snd_pcm_drain() uses init_waitqueue_entry which does not clear
  entry.prev/next, and add_…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.10.253, < 5.10.259'
  - 'linux_kernel >= 6.1.167, < 6.1.176'
  - 'linux_kernel >= 6.6.130, < 6.6.143'
  - 'linux_kernel >= 6.12.78, < 6.12.94'
  - 'linux_kernel >= 6.18.19, < 6.18.36'
  - 'linux_kernel >= 6.19.9, < 7.0'
  - 'linux_kernel >= 7.0.1, < 7.0.13'
  - linux_kernel = 7.0
  - linux_kernel = 7.1
patched:
  - linux_kernel 7.0.13
published: '2026-06-25'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:20:06.347'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53242'
references:
  - url: 'https://git.kernel.org/stable/c/06eca2235a3fd281dddf25b0a97772b25b5bb573'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7c71a9522555ff137a9ca36b15d759ca04d84788'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/88fe2e3658726cb21ff2dcf9770bf672f9b9d31b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b053fcd8912f06c30f932f5b8ec41c72de474695'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cac5bf3500ee6422cf64e0df0b5daeecfed42917'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cd98837db15f323463b8df07282ac723bd5c3fed'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d68b621bb5a48051932f1017a6e1bc9b18f854d0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d842f26a167e77a36f3ed333b9fa99d36ef99fe6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00129
epssPercentile: 0.02267
ingestedAt: '2026-10-15T03:30:12.909Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

snd_pcm_drain() uses init_waitqueue_entry which does not clear
entry.prev/next, and add_wait_queue with a conditional
remove_wait_queue that is skipped when to_check is no longer
in the group after concurrent UNLINK.  The orphaned wait entry
remains on the unlinked substream sleep queue.  On the next
drain iteration, add_wait_queue adds the entry to a new queue
while still linked on the old one, corrupting both lists.  A
subsequent wake_up dereferences NULL at the func pointer
(mapped from the spinlock at offset 0 of the misinterpreted
wait_queue_head_t), causing a kernel panic.

Replace init_waitqueue_entry/add_wait_queue/conditional
remove_wait_queue with init_wait_entry/prepare_to_wait/
finish_wait.  init_wait_entry clears prev/next via
INIT_LIST_HEAD on each iteration and sets
autoremove_wake_function which auto-removes the entry on
wake-up.  finish_wait safely handles both the already-removed
and still-queued cases.

## Affected

- `linux_kernel >= 5.10.253, < 5.10.259`
- `linux_kernel >= 6.1.167, < 6.1.176`
- `linux_kernel >= 6.6.130, < 6.6.143`
- `linux_kernel >= 6.12.78, < 6.12.94`
- `linux_kernel >= 6.18.19, < 6.18.36`
- `linux_kernel >= 6.19.9, < 7.0`
- `linux_kernel >= 7.0.1, < 7.0.13`
- `linux_kernel = 7.0`
- `linux_kernel = 7.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.13`