CVE-2026-46157: Linux Kernel Race Condition Vulnerability

CVE-2026-46157 Overview

CVE-2026-46157 is a data race vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Open Sound System (OSS) Pulse Code Modulation (PCM) emulation layer. The flaw resides in concurrent access to the runtime.oss.trigger bit field without proper synchronization. Because the affected field is part of a bit field, unprotected writes can overwrite adjacent bits and corrupt unrelated state. The issue was identified through fuzzing of the kernel audio subsystem. Upstream maintainers resolved it by extending the existing params_lock mutex coverage in snd_pcm_oss_get_trigger() and snd_pcm_oss_poll().

Critical Impact
Concurrent access to the runtime.oss.trigger bit field can corrupt unrelated bit fields, destabilizing PCM OSS state and producing unpredictable kernel behavior.

Affected Products

Linux kernel ALSA PCM OSS emulation layer
Distributions shipping affected Linux kernel versions
Systems with the snd-pcm-oss module loaded

Discovery Timeline

2026-05-28 - CVE-2026-46157 published to the National Vulnerability Database
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46157

Vulnerability Analysis

The vulnerability is a race condition in the ALSA PCM OSS compatibility layer of the Linux kernel. The runtime.oss.trigger field is declared as a bit field within a larger structure that holds OSS-specific runtime state. Multiple code paths, including snd_pcm_oss_get_trigger() and snd_pcm_oss_poll(), read or update this field without holding the params_lock mutex. Concurrent userspace callers invoking PCM OSS ioctl and poll operations on the same device can trigger overlapping read-modify-write sequences against this bit field.

Bit fields are not updated atomically at the machine level. The compiler emits load, mask, modify, and store instructions against the containing word. When two threads execute this sequence simultaneously, writes to neighboring bits in the same word are lost or overwritten, leaving the OSS state machine in an inconsistent configuration.

Root Cause

The root cause is missing mutex protection around accesses to the runtime.oss.trigger bit field. The surrounding code already uses params_lock to serialize other runtime parameter changes, but the trigger field accessors were omitted from that protection. The issue surfaced through kernel fuzzing, which exercised concurrent ioctl and poll paths against PCM OSS devices.

Attack Vector

A local user with access to an OSS-emulated PCM device node, such as /dev/dsp, can open the device from multiple threads and invoke trigger-related ioctls or poll() calls concurrently. The resulting bit field corruption can confuse OSS state tracking and lead to inconsistent behavior in the audio subsystem. See the upstream commits referenced below for the precise call sites and patched logic.

Reference patches: commit 49f9d04, commit 6b01c1b, commit 901ac0f, and commit ac3e9b5.

Detection Methods for CVE-2026-46157

Indicators of Compromise

Unexpected kernel warnings or KCSAN data race reports referencing snd_pcm_oss_get_trigger or snd_pcm_oss_poll.
Audio subsystem instability on hosts exposing /dev/dsp or other OSS-emulated device nodes to untrusted local users.
Processes opening /dev/dsp* from multiple threads in rapid succession without a legitimate audio workload.

Detection Strategies

Inventory hosts where the snd-pcm-oss module is loaded using lsmod | grep snd_pcm_oss and compare kernel versions against the patched commits.
Enable Kernel Concurrency Sanitizer (KCSAN) in test environments to surface remaining races touching runtime.oss.trigger.
Audit local user access to OSS device nodes through filesystem permissions and auditd rules on /dev/dsp*.

Monitoring Recommendations

Monitor dmesg and journald for ALSA, KCSAN, or lockdep messages tied to the PCM OSS code paths.
Track process activity that issues ioctls against /dev/dsp* from multiple threads of the same PID.
Alert on unpatched kernel versions remaining in production after distribution patches are released.

How to Mitigate CVE-2026-46157

Immediate Actions Required

Apply the upstream Linux kernel patches that extend params_lock coverage to runtime.oss.trigger accesses.
Update to a distribution kernel package that incorporates the referenced stable commits.
Where patching is not yet possible, unload the snd-pcm-oss module on systems that do not require OSS audio emulation.

Patch Information

The fix is delivered through the Linux stable tree in commits 49f9d04, 6b01c1b, 901ac0f, and ac3e9b5. The patches wrap runtime.oss.trigger reads and writes in snd_pcm_oss_get_trigger() and snd_pcm_oss_poll() with the existing params_lock mutex, eliminating the race against the surrounding bit field.

Workarounds

Blacklist the snd-pcm-oss module via /etc/modprobe.d/ on systems that do not need OSS compatibility.
Restrict permissions on /dev/dsp* device nodes so that only trusted service accounts can open them.
Disable multi-seat or shell access for untrusted local users on hosts that must keep OSS emulation enabled.

bash

# Configuration example: prevent loading of the affected module
echo "blacklist snd_pcm_oss" | sudo tee /etc/modprobe.d/disable-snd-pcm-oss.conf
sudo rmmod snd_pcm_oss 2>/dev/null || true
sudo update-initramfs -u