CVE-2026-80716

CVE-2026-80716 is a use-after-free bug in the Linux kernel's ALSA PCM core: when snd_pcm_drain() waits on a linked peer stream, it parks a stack-based wait entry on that peer's sleep queue, and after the wait it removes the entry only if the peer is still in the caller's group — if the streams are unlinked during the wait and the wait ends via signal or timeout, finish_wait() is skipped and the stale entry is left on the peer's wait list. A later wake_up() on that stream then walks a freed stack frame, corrupting kernel memory; unlike the close path (snd_pcm_drop() -> snd_pcm_post_stop()), snd_pcm_unlink() never wakes the sleep queues, which is why the dangling entry survives. A local user who can open ALSA PCM devices, link two streams, start a drain, and unlink a stream during the drain wait can trigger this, gaining at minimum a kernel crash (denial of service) and potentially local privilege escalation, consistent with the CVSS 7.8 local-vector score with high confidentiality, integrity and availability impact. Any Linux system whose kernel includes ALSA PCM support is affected — in practice nearly all desktop, laptop, server and embedded distributions. There is currently no public proof-of-concept, no evidence of in-the-wild exploitation (EPSS 0.1%, not in CISA KEV).

What to do: Update the Linux kernel to a build containing the upstream fix 'ALSA: pcm: wake linked drain waiters on unlink' as soon as your distribution ships it — no fixed version numbers are listed in this advisory, so track your distro's kernel errata for this CVE. As interim mitigation, restrict unprivileged local users' access to ALSA device nodes (/dev/snd/*) and avoid running untrusted local code that uses linked PCM streams. Current risk is low: no public PoC, EPSS 0.1%, and not listed in CISA KEV.