CVE-2026-80967

The Linux kernel's ALSA pcxhr driver (for Digigram PCXHR professional audio cards) calls request_threaded_irq() in pcxhr_probe() before initializing the mgr->lock mutex, while the threaded IRQ handler takes that same mutex. A sufficiently early hardware interrupt during device probe can therefore run against uninitialized mutex state, causing undefined behavior that can range from a kernel crash to potential memory corruption. Because the flaw requires local presence on a machine during the narrow probe window (boot or hotplug of a supported Digigram card), real-world exploitability is far lower than the CVSS 8.4 rating suggests despite its AV:L/PR:N scoring. Affected systems are Linux installations with the snd-pcxhr driver enabled and Digigram PCXHR-family hardware installed, which is primarily radio-broadcast playout infrastructure. No public proof of concept exists, the issue is not in CISA's KEV catalog, and no exploitation has been observed.

What to do: Upgrade to a kernel release containing the upstream fix that initializes the pcxhr manager mutexes before request_threaded_irq(). On systems without Digigram PCXHR audio hardware, blacklist the snd-pcxhr module so it cannot be autoloaded. Since exploitation requires local access during the probe race window, restricting local untrusted accounts and module-load privileges further reduces risk.