--- cve: "CVE-2026-80716" severity: "LOW" cvss: 3.1 epss: "2.4%" vendor: "Linux" kev: false exploited: false published: "2026-08-28 08:16:57" tags: [cve, security, low] source: tsecurity.de CVE-Dossier exported: "2026-09-03T04:54:42+02:00" --- # CVE-2026-80716 > 3.1 LOW ## Beschreibung In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink snd_pcm_drain() on a linked stream parks an on-stack wait entry on the drained peer's runtime->sleep, and after schedule_timeout() removes it only if that peer is still found in the caller's group. If group membership changes during the wait and the sleep ends by signal or timeout (so autoremove_wake_function() does not run), finish_wait() is skipped and snd_pcm_drain() returns with the entry still queued on that stream's sleep list; a later wake_up() then walks a freed stack frame. This is reachable by unlinking either the drained or the draining stream. Unlike the close path (snd_pcm_drop() -> snd_pcm_post_stop()), snd_pcm_unlink() never wakes the sleep queues. Wake every group member under the group lock before the membership change, so a linked drainer is released and drops its entry while the streams are still grouped. The window was opened when snd_pcm_link_rwsem stopped being held across the wait and the removal became conditional on group membership (see Fixes). The later switch to finish_wait() kept that conditional removal, so the signal/timeout case remained. ## Patch verfügbar (OSV) - Kernel ≥ 5.10.265 - Kernel ≥ 5.15.216 - Kernel ≥ 6.1.183 - Kernel ≥ 6.6.151 - Kernel ≥ 6.12.103 - Kernel ≥ 6.18.44 - Kernel ≥ 7.1.8 ## Referenzen - - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-80716) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_