CVE-2026-80628

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80628", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.775Z", "datePublished": "2026-08-28T06:48:45.377Z", "dateUpdated": "2026-10-30T12:30:45.686Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:30:45.686Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: oss: Serialize readq reset state with q->lock\n\nsnd_seq_oss_readq_clear() resets qlen, head, and tail without\nq->lock even though the normal reader and producer paths serialize the\nsame ring state under that spinlock. A reset can therefore race\nsnd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and leave\nstale records in the queue, drop freshly queued ones, or report the\nwrong readiness after wakeup. KCSAN reports a data race between\nsnd_seq_oss_readq_clear() and snd_seq_oss_readq_free().\n\nTake q->lock while clearing the ring and resetting input_time. Factor\nthe enqueue logic into a caller-locked helper so\nsnd_seq_oss_readq_put_timestamp() updates its suppression state under\nthe same lock instead of racing the reset path.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\nreset path: locked readq updater:\n1. snd_seq_oss_reset() or 1. A reader or callback producer\n release reaches takes q->lock on the same queue.\n snd_seq_oss_readq_clear().\n2. snd_seq_oss_readq_clear() 2. The updater tests or modifies\n resets qlen, head, tail, qlen, head, and tail.\n and input_time.\n3. snd_seq_oss_readq_clear() 3. The updater completes its\n wakes sleepers on read-modify-write sequence.\n q->midi_sleep.\n4. Without q->lock, the reset 4. The resulting ring state drives\n can overlap the locked later reads and readiness.\n update.\n\nKCSAN reports:\n\nBUG: KCSAN: data-race in snd_seq_oss_readq_clear /\nsnd_seq_oss_readq_free\n\nwrite to 0xffff8881069fe608 of 4 bytes by task 120516 on cpu 0:\n snd_seq_oss_readq_free+0x6c/0x80\n snd_seq_oss_read+0xcb/0x250\n odev_read+0x38/0x60\n vfs_read+0xff/0x600\n ksys_read+0xb4/0x140\n __x64_sys_read+0x46/0x60\n do_syscall_64+0xbb/0x2f0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nread to 0xffff8881069fe608 of 4 bytes by task 120517 on cpu 1:\n snd_seq_oss_readq_clear+0x1f/0x90\n snd_seq_oss_reset+0xa7/0xf0\n snd_seq_oss_ioctl+0x6f6/0x7e0\n odev_ioctl+0x56/0xc0\n __x64_sys_ioctl+0xd1/0x120\n do_syscall_64+0xbb/0x2f0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x00000001 -> 0x00000000"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local syscall access to OSS sequencer character devices (/dev/sequencer or /dev/music) via read(2), ioctl(SNDCTL_SEQ_RESET/SNDCTL_SEQ_PANIC), or release; there is no network, Bluetooth, or physical-bus path into snd_seq_oss_readq_clear().\nAC:L - The attacker controls both race participants on the same fd (one thread ioctl reset or close while another read(2)s, or concurrent MIDI enqueue via sequencer callbacks) and can hammer the timing window without conditions outside attacker control.\nPR:L - odev_open/read/ioctl perform no capability checks; desktop, studio, and kiosk systems routinely grant unprivileged users access to /dev/sequencer via audio group or logind ACLs, and attackers can create ALSA MIDI ports to satisfy open requirements.\nUI:N - Triggering the race requires only the attacker's own threads or processes opening the sequencer and issuing reset/read; no separate victim action such as plugging hardware, mounting filesystems, or opening files on behalf of another user.\nS:U - Corruption is confined to the kernel OSS sequencer read queue within the same security domain; this is a standard local kernel memory-safety issue with no VM, IOMMU, or container-escape boundary crossed.\nC:H - Unlocked snd_seq_oss_readq_clear() races locked dequeue/enqueue on qlen/head/tail, yielding inconsistent ring state that can drive snd_seq_oss_readq_pick() and copy_to_user() to return unintended queue slots and expose stale kernel heap contents.\nI:H - The same race corrupts ring indices and length while snd_seq_oss_readq_put_event_locked() memcpy-writes events, enabling out-of-sync overwrites within the kmalloc'd queue object that can be groomed toward arbitrary kernel memory modification.\nA:H - Corrupted qlen/head/tail and wakeup state from the unlocked reset can strand readers in wait/poll loops and deny MIDI/audio input on kiosk, studio, and media systems; the KCSAN-proven race is attacker-repeatable via ioctl reset concurrent with read(2)."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/core/seq/oss/seq_oss_readq.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "cf58e4abf61d6643446f08ce69993688bb914420", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "bf862fdee4831fe1dbde20891db4b29b8f9972f7", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "af74390983cae3e5e551a533d6fcfc9b8c1a8b9e", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "287d506d4e0865918cec82bb1361f283a08c979b", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "43e10709b1ba288bcbabb9b9cb6e518b2a5d8506", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "49ce92d207820f588b0406add82f053decfbe5d9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/core/seq/oss/seq_oss_readq.c"], "versions": [{"version": "2.6.12", "status": "affected"}, {"version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cf58e4abf61d6643446f08ce69993688bb914420"}, {"url": "https://git.kernel.org/stable/c/bf862fdee4831fe1dbde20891db4b29b8f9972f7"}, {"url": "https://git.kernel.org/stable/c/af74390983cae3e5e551a533d6fcfc9b8c1a8b9e"}, {"url": "https://git.kernel.org/stable/c/287d506d4e0865918cec82bb1361f283a08c979b"}, {"url": "https://git.kernel.org/stable/c/43e10709b1ba288bcbabb9b9cb6e518b2a5d8506"}, {"url": "https://git.kernel.org/stable/c/49ce92d207820f588b0406add82f053decfbe5d9"}], "title": "ALSA: seq: oss: Serialize readq reset state with q->lock", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-80628", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:18:58.858599Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:26:31.108Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-80628", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:18:58.858599Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:18:59.666Z"}}], "cna": {"title": "ALSA: seq: oss: Serialize readq reset state with q->lock", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local syscall access to OSS sequencer character devices (/dev/sequencer or /dev/music) via read(2), ioctl(SNDCTL_SEQ_RESET/SNDCTL_SEQ_PANIC), or release; there is no network, Bluetooth, or physical-bus path into snd_seq_oss_readq_clear().\nAC:L - The attacker controls both race participants on the same fd (one thread ioctl reset or close while another read(2)s, or concurrent MIDI enqueue via sequencer callbacks) and can hammer the timing window without conditions outside attacker control.\nPR:L - odev_open/read/ioctl perform no capability checks; desktop, studio, and kiosk systems routinely grant unprivileged users access to /dev/sequencer via audio group or logind ACLs, and attackers can create ALSA MIDI ports to satisfy open requirements.\nUI:N - Triggering the race requires only the attacker's own threads or processes opening the sequencer and issuing reset/read; no separate victim action such as plugging hardware, mounting filesystems, or opening files on behalf of another user.\nS:U - Corruption is confined to the kernel OSS sequencer read queue within the same security domain; this is a standard local kernel memory-safety issue with no VM, IOMMU, or container-escape boundary crossed.\nC:H - Unlocked snd_seq_oss_readq_clear() races locked dequeue/enqueue on qlen/head/tail, yielding inconsistent ring state that can drive snd_seq_oss_readq_pick() and copy_to_user() to return unintended queue slots and expose stale kernel heap contents.\nI:H - The same race corrupts ring indices and length while snd_seq_oss_readq_put_event_locked() memcpy-writes events, enabling out-of-sync overwrites within the kmalloc'd queue object that can be groomed toward arbitrary kernel memory modification.\nA:H - Corrupted qlen/head/tail and wakeup state from the unlocked reset can strand readers in wait/poll loops and deny MIDI/audio input on kiosk, studio, and media systems; the KCSAN-proven race is attacker-repeatable via ioctl reset concurrent with read(2)."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "bf862fdee4831fe1dbde20891db4b29b8f9972f7", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "af74390983cae3e5e551a533d6fcfc9b8c1a8b9e", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "287d506d4e0865918cec82bb1361f283a08c979b", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "43e10709b1ba288bcbabb9b9cb6e518b2a5d8506", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "49ce92d207820f588b0406add82f053decfbe5d9", "versionType": "git"}], "programFiles": ["sound/core/seq/oss/seq_oss_readq.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.12"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["sound/core/seq/oss/seq_oss_readq.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/bf862fdee4831fe1dbde20891db4b29b8f9972f7"}, {"url": "https://git.kernel.org/stable/c/af74390983cae3e5e551a533d6fcfc9b8c1a8b9e"}, {"url": "https://git.kernel.org/stable/c/287d506d4e0865918cec82bb1361f283a08c979b"}, {"url": "https://git.kernel.org/stable/c/43e10709b1ba288bcbabb9b9cb6e518b2a5d8506"}, {"url": "https://git.kernel.org/stable/c/49ce92d207820f588b0406add82f053decfbe5d9"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: oss: Serialize readq reset state with q->lock\n\nsnd_seq_oss_readq_clear() resets qlen, head, and tail without\nq->lock even though the normal reader and producer paths serialize the\nsame ring state under that spinlock. A reset can therefore race\nsnd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and leave\nstale records in the queue, drop freshly queued ones, or report the\nwrong readiness after wakeup. KCSAN reports a data race between\nsnd_seq_oss_readq_clear() and snd_seq_oss_readq_free().\n\nTake q->lock while clearing the ring and resetting input_time. Factor\nthe enqueue logic into a caller-locked helper so\nsnd_seq_oss_readq_put_timestamp() updates its suppression state under\nthe same lock instead of racing the reset path.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\nreset path: locked readq updater:\n1. snd_seq_oss_reset() or 1. A reader or callback producer\n release reaches takes q->lock on the same queue.\n snd_seq_oss_readq_clear().\n2. snd_seq_oss_readq_clear() 2. The updater tests or modifies\n resets qlen, head, tail, qlen, head, and tail.\n and input_time.\n3. snd_seq_oss_readq_clear() 3. The updater completes its\n wakes sleepers on read-modify-write sequence.\n q->midi_sleep.\n4. Without q->lock, the reset 4. The resulting ring state drives\n can overlap the locked later reads and readiness.\n update.\n\nKCSAN reports:\n\nBUG: KCSAN: data-race in snd_seq_oss_readq_clear /\nsnd_seq_oss_readq_free\n\nwrite to 0xffff8881069fe608 of 4 bytes by task 120516 on cpu 0:\n snd_seq_oss_readq_free+0x6c/0x80\n snd_seq_oss_read+0xcb/0x250\n odev_read+0x38/0x60\n vfs_read+0xff/0x600\n ksys_read+0xb4/0x140\n __x64_sys_read+0x46/0x60\n do_syscall_64+0xbb/0x2f0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nread to 0xffff8881069fe608 of 4 bytes by task 120517 on cpu 1:\n snd_seq_oss_readq_clear+0x1f/0x90\n snd_seq_oss_reset+0xa7/0xf0\n snd_seq_oss_ioctl+0x6f6/0x7e0\n odev_ioctl+0x56/0xc0\n __x64_sys_ioctl+0xd1/0x120\n do_syscall_64+0xbb/0x2f0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x00000001 -> 0x00000000"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "2.6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "2.6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "2.6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "2.6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "2.6.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:46:38.235Z"}}}, "cveMetadata": {"cveId": "CVE-2026-80628", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:46:38.235Z", "dateReserved": "2026-08-26T14:34:25.775Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-28T06:48:45.377Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/core/seq/oss/seq_oss_readq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cf58e4abf61d6643446f08ce69993688bb914420", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "bf862fdee4831fe1dbde20891db4b29b8f9972f7", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "af74390983cae3e5e551a533d6fcfc9b8c1a8b9e", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "287d506d4e0865918cec82bb1361f283a08c979b", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "43e10709b1ba288bcbabb9b9cb6e518b2a5d8506", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "49ce92d207820f588b0406add82f053decfbe5d9", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/core/seq/oss/seq_oss_readq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.12"}, {"lessThan": "2.6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: oss: Serialize readq reset state with q->lock\n\nsnd_seq_oss_readq_clear() resets qlen, head, and tail without\nq->lock even though the normal reader and producer paths serialize the\nsame ring state under that spinlock. A reset can therefore race\nsnd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and leave\nstale records in the queue, drop freshly queued ones, or report the\nwrong readiness after wakeup. KCSAN reports a data race between\nsnd_seq_oss_readq_clear() and snd_seq_oss_readq_free().\n\nTake q->lock while clearing the ring and resetting input_time. Factor\nthe enqueue logic into a caller-locked helper so\nsnd_seq_oss_readq_put_timestamp() updates its suppression state under\nthe same lock instead of racing the reset path.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\nreset path: locked readq updater:\n1. snd_seq_oss_reset() or 1. A reader or callback producer\n release reaches takes q->lock on the same queue.\n snd_seq_oss_readq_clear().\n2. snd_seq_oss_readq_clear() 2. The updater tests or modifies\n resets qlen, head, tail, qlen, head, and tail.\n and input_time.\n3. snd_seq_oss_readq_clear() 3. The updater completes its\n wakes sleepers on read-modify-write sequence.\n q->midi_sleep.\n4. Without q->lock, the reset 4. The resulting ring state drives\n can overlap the locked later reads and readiness.\n update.\n\nKCSAN reports:\n\nBUG: KCSAN: data-race in snd_seq_oss_readq_clear /\nsnd_seq_oss_readq_free\n\nwrite to 0xffff8881069fe608 of 4 bytes by task 120516 on cpu 0:\n snd_seq_oss_readq_free+0x6c/0x80\n snd_seq_oss_read+0xcb/0x250\n odev_read+0x38/0x60\n vfs_read+0xff/0x600\n ksys_read+0xb4/0x140\n __x64_sys_read+0x46/0x60\n do_syscall_64+0xbb/0x2f0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nread to 0xffff8881069fe608 of 4 bytes by task 120517 on cpu 1:\n snd_seq_oss_readq_clear+0x1f/0x90\n snd_seq_oss_reset+0xa7/0xf0\n snd_seq_oss_ioctl+0x6f6/0x7e0\n odev_ioctl+0x56/0xc0\n __x64_sys_ioctl+0xd1/0x120\n do_syscall_64+0xbb/0x2f0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x00000001 -> 0x00000000"}], "id": "CVE-2026-80628", "lastModified": "2026-10-30T13:20:08.290", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-80628", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:18:58.858599Z", "version": "2.0.3"}}]}, "published": "2026-08-28T08:16:47.007", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/287d506d4e0865918cec82bb1361f283a08c979b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/43e10709b1ba288bcbabb9b9cb6e518b2a5d8506"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/49ce92d207820f588b0406add82f053decfbe5d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/af74390983cae3e5e551a533d6fcfc9b8c1a8b9e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf862fdee4831fe1dbde20891db4b29b8f9972f7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cf58e4abf61d6643446f08ce69993688bb914420"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: seq: oss: Serialize readq reset state with q->lock", "id": "2525502", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525502"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-820", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: seq: oss: Serialize readq reset state with q->lock\nsnd_seq_oss_readq_clear() resets qlen, head, and tail without\nq->lock even though the normal reader and producer paths serialize the\nsame ring state under that spinlock. A reset can therefore race\nsnd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and leave\nstale records in the queue, drop freshly queued ones, or report the\nwrong readiness after wakeup. KCSAN reports a data race between\nsnd_seq_oss_readq_clear() and snd_seq_oss_readq_free().\nTake q->lock while clearing the ring and resetting input_time. Factor\nthe enqueue logic into a caller-locked helper so\nsnd_seq_oss_readq_put_timestamp() updates its suppression state under\nthe same lock instead of racing the reset path.\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\nreset path: locked readq updater:\n1. snd_seq_oss_reset() or 1. A reader or callback producer\nrelease reaches takes q->lock on the same queue.\nsnd_seq_oss_readq_clear().\n2. snd_seq_oss_readq_clear() 2. The updater tests or modifies\nresets qlen, head, tail, qlen, head, and tail.\nand input_time.\n3. snd_seq_oss_readq_clear() 3. The updater completes its\nwakes sleepers on read-modify-write sequence.\nq->midi_sleep.\n4. Without q->lock, the reset 4. The resulting ring state drives\ncan overlap the locked later reads and readiness.\nupdate.\nKCSAN reports:\nBUG: KCSAN: data-race in snd_seq_oss_readq_clear /\nsnd_seq_oss_readq_free\nwrite to 0xffff8881069fe608 of 4 bytes by task 120516 on cpu 0:\nsnd_seq_oss_readq_free+0x6c/0x80\nsnd_seq_oss_read+0xcb/0x250\nodev_read+0x38/0x60\nvfs_read+0xff/0x600\nksys_read+0xb4/0x140\n__x64_sys_read+0x46/0x60\ndo_syscall_64+0xbb/0x2f0\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\nread to 0xffff8881069fe608 of 4 bytes by task 120517 on cpu 1:\nsnd_seq_oss_readq_clear+0x1f/0x90\nsnd_seq_oss_reset+0xa7/0xf0\nsnd_seq_oss_ioctl+0x6f6/0x7e0\nodev_ioctl+0x56/0xc0\n__x64_sys_ioctl+0xd1/0x120\ndo_syscall_64+0xbb/0x2f0\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\nvalue changed: 0x00000001 -> 0x00000000", "A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) sequencer OSS (Open Sound System) emulation. A local user could exploit a data race condition when the `snd_seq_oss_readq_clear()` function resets the read queue state without proper locking. This can lead to stale records, dropped events, or incorrect readiness reporting, potentially causing system instability or a denial of service (DoS)."], "name": "CVE-2026-80628", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80628\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80628\nhttps://lore.kernel.org/linux-cve-announce/2026082838-CVE-2026-80628-4952@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,287d506d4e0865918cec82bb1361f283a08c979b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,43e10709b1ba288bcbabb9b9cb6e518b2a5d8506)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,49ce92d207820f588b0406add82f053decfbe5d9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,2.6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-28T10:30:17.561617+00:00", "updated": "2026-08-31T14:15:06.425101+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}