Answer in brief
CVE-2026-53242 records a High severity (CVSS 7.8) vulnerability in ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-53242 records a High severity (CVSS 7.8) vulnerability in ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9baee36e8c5443411c4629afabafaff8a46a23fd <cac5bf3500ee6422cf64e0df0b5daeecfed42917 || >=fc71f888994569f87d5bee20b1ac6c9c1e3a7a79 <d842f26a167e77a36f3ed333b9fa99d36ef99fe6 || >=629cf09464cf98670996ea5c191dc9743e6f3f00 <d68b621bb5a48051932f1017a6e1bc9b18f854d0 || >=ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432 <b053fcd8912f06c30f932f5b8ec41c72de474695 || >=4a758e9a1f5ed722f83c4dd35f867fe811553bcb <cd98837db15f323463b8df07282ac723bd5c3fed || >=9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 <7c71a9522555ff137a9ca36b15d759ca04d84788 || >=9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 <88fe2e3658726cb21ff2dcf9770bf672f9b9d31b || c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694 || >=5.10.253 <5.10.259 || >=6.1.167 <6.1.176 || >=6.6.130 <6.6.143 || >=6.12.78 <6.12.94 || >=6.18.19 <6.18.36 || >=6.19.9 <6.20 | cac5bf3500ee6422cf64e0df0b5daeecfed42917, d842f26a167e77a36f3ed333b9fa99d36ef99fe6, d68b621bb5a48051932f1017a6e1bc9b18f854d0, b053fcd8912f06c30f932f5b8ec41c72de474695, cd98837db15f323463b8df07282ac723bd5c3fed, 7c71a9522555ff137a9ca36b15d759ca04d84788, 88fe2e3658726cb21ff2dcf9770bf672f9b9d31b, 5.10.259, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 6.20 |
| Linux/Linuxgeneric | 7.0 | Not reported |
Published upstream
Jun 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 25, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams snd_pcm_drain() uses init_waitqueue_entry which does not clear entry.prev/next, and add_wait_queue with a conditional remove_wait_queue that is skipped when to_check is no longer in the group after concurrent UNLINK. The orphaned wait entry remains on the unlinked substream sleep queue. On the next drain iteration, add_wait_queue adds the entry to a new queue while still linked on the old one, corrupting both lists. A subsequent wake_up dereferences NULL at the func pointer (mapped from the spinlock at offset 0 of the misinterpreted wait_queue_head_t), causing a kernel panic. Replace init_waitqueue_entry/add_wait_queue/conditional remove_wait_queue with init_wait_entry/prepare_to_wait/ finish_wait. init_wait_entry clears prev/next via INIT_LIST_HEAD on each iteration and sets autoremove_wake_function which auto-removes the entry on wake-up. finish_wait safely handles both the already-removed and still-queued cases.
Quoted source text, attributed separately from HOL analysis.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9baee36e8c5443411c4629afabafaff8a46a23fd <cac5bf3500ee6422cf64e0df0b5daeecfed42917 || >=fc71f888994569f87d5bee20b1ac6c9c1e3a7a79 <d842f26a167e77a36f3ed333b9fa99d36ef99fe6 || >=629cf09464cf98670996ea5c191dc9743e6f3f00 <d68b621bb5a48051932f1017a6e1bc9b18f854d0 || >=ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432 <b053fcd8912f06c30f932f5b8ec41c72de474695 || >=4a758e9a1f5ed722f83c4dd35f867fe811553bcb <cd98837db15f323463b8df07282ac723bd5c3fed || >=9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 <7c71a9522555ff137a9ca36b15d759ca04d84788 || >=9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 <88fe2e3658726cb21ff2dcf9770bf672f9b9d31b || c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694 || >=5.10.253 <5.10.259 || >=6.1.167 <6.1.176 || >=6.6.130 <6.6.143 || >=6.12.78 <6.12.94 || >=6.18.19 <6.18.36 || >=6.19.9 <6.20 | cac5bf3500ee6422cf64e0df0b5daeecfed42917, d842f26a167e77a36f3ed333b9fa99d36ef99fe6, d68b621bb5a48051932f1017a6e1bc9b18f854d0, b053fcd8912f06c30f932f5b8ec41c72de474695, cd98837db15f323463b8df07282ac723bd5c3fed, 7c71a9522555ff137a9ca36b15d759ca04d84788, 88fe2e3658726cb21ff2dcf9770bf672f9b9d31b, 5.10.259, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 6.20 |
| Linux/Linuxgeneric | 7.0 | Not reported |
Published upstream
Jun 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 25, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams snd_pcm_drain() uses init_waitqueue_entry which does not clear entry.prev/next, and add_wait_queue with a conditional remove_wait_queue that is skipped when to_check is no longer in the group after concurrent UNLINK. The orphaned wait entry remains on the unlinked substream sleep queue. On the next drain iteration, add_wait_queue adds the entry to a new queue while still linked on the old one, corrupting both lists. A subsequent wake_up dereferences NULL at the func pointer (mapped from the spinlock at offset 0 of the misinterpreted wait_queue_head_t), causing a kernel panic. Replace init_waitqueue_entry/add_wait_queue/conditional remove_wait_queue with init_wait_entry/prepare_to_wait/ finish_wait. init_wait_entry clears prev/next via INIT_LIST_HEAD on each iteration and sets autoremove_wake_function which auto-removes the entry on wake-up. finish_wait safely handles both the already-removed and still-queued cases.
Quoted source text, attributed separately from HOL analysis.