CVE-2026-80716

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: pcm: wake linked drain waiters on unlink<br /> <br /> snd_pcm_drain() on a linked stream parks an on-stack wait entry on the<br /> drained peer&amp;#39;s runtime-&gt;sleep, and after schedule_timeout() removes it<br /> only if that peer is still found in the caller&amp;#39;s group. If group<br /> membership changes during the wait and the sleep ends by signal or<br /> timeout (so autoremove_wake_function() does not run), finish_wait() is<br /> skipped and snd_pcm_drain() returns with the entry still queued on that<br /> stream&amp;#39;s sleep list; a later wake_up() then walks a freed stack frame.<br /> This is reachable by unlinking either the drained or the draining stream.<br /> <br /> Unlike the close path (snd_pcm_drop() -&gt; snd_pcm_post_stop()),<br /> snd_pcm_unlink() never wakes the sleep queues. Wake every group member<br /> under the group lock before the membership change, so a linked drainer is<br /> released and drops its entry while the streams are still grouped.<br /> <br /> The window was opened when snd_pcm_link_rwsem stopped being held across<br /> the wait and the removal became conditional on group membership (see<br /> Fixes). The later switch to finish_wait() kept that conditional removal,<br /> so the signal/timeout case remained.