CVE-2026-89980

The Linux kernel's ALSA harmony driver, the sound driver for HP PA-RISC machines, registered its interrupt request in snd_harmony_create() before initializing the h->lock and h->mixer_lock spinlocks, so a pending interrupt could invoke the IRQ handler while the locks were still uninitialized. This race is triggered when an interrupt arrives in the window between IRQ registration and lock initialization, typically during driver probe or boot. A local attacker able to trigger or time this race could cause kernel crashes or memory corruption, potentially yielding denial of service or privilege escalation, consistent with the CVSS 8.4 local-vector score. Only systems running Linux on the HP PA-RISC architecture with the Harmony audio driver built and enabled are affected; mainstream x86 and ARM deployments do not include this driver. There is no known exploitation, no public proof-of-concept, and the issue is not listed in CISA's KEV catalog.

What to do: Apply the upstream kernel patch (initialize both locks before requesting the IRQ) via your stable kernel update channel. Inventory for any HP PA-RISC/HP 9000 systems running Linux and check whether the harmony ALSA driver is enabled; as an interim measure, disable or avoid CONFIG_SND_HARMONY if patching is not immediately possible. x86/ARM and other mainstream architectures are not affected.