CVE-2026-80628

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: oss: Serialize readq reset state with q->lock

snd_seq_oss_readq_clear() resets qlen, head, and tail without

q->lock even though the normal reader and producer paths serialize the

same ring state under that spinlock. A reset can therefore race

snd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and leave

stale records in the queue, drop freshly queued ones, or report the

wrong readiness after wakeup. KCSAN reports a data race between

snd_seq_oss_readq_clear() and snd_seq_oss_readq_free().

Take q->lock while clearing the ring and resetting input_time. Factor

the enqueue logic into a caller-locked helper so

snd_seq_oss_readq_put_timestamp() updates its suppression state under

the same lock instead of racing the reset path.

The buggy scenario involves two paths, with each column showing the

order within that path:

reset path: locked readq updater:

1. snd_seq_oss_reset() or

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References