CVE-2026-80628: Linux Kernel ALSA Race Condition Vulnerability

CVE-2026-80628 Overview

CVE-2026-80628 is a race condition in the Linux kernel's Advanced Linux Sound Architecture (ALSA) sequencer Open Sound System (OSS) emulation layer. The function snd_seq_oss_readq_clear() resets the qlen, head, and tail fields of the read queue without acquiring q->lock. Normal reader and producer paths serialize the same ring state under that spinlock, so a concurrent reset can race snd_seq_oss_readq_free() or snd_seq_oss_readq_put_event(). Kernel Concurrency Sanitizer (KCSAN) confirms a data race between these paths.

Critical Impact
A local user with access to an OSS sequencer device can trigger stale records, dropped events, or incorrect readiness reporting via a concurrent reset, corrupting audio queue state on the running kernel.

Affected Products

Linux kernel (mainline) — ALSA sequencer OSS emulation subsystem
Stable branches receiving the fix in commits 287d506, 43e1070, and 49ce92d
Distributions shipping vulnerable pre-patch kernel builds with CONFIG_SND_SEQUENCER_OSS enabled

Discovery Timeline

2026-08-28 - CVE-2026-80628 published to the National Vulnerability Database (NVD)
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80628

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] in the ALSA sequencer OSS read queue. The read queue tracks incoming MIDI events using a ring buffer described by qlen, head, and tail. Reader and producer paths — snd_seq_oss_readq_free() and snd_seq_oss_readq_put_event() — acquire q->lock before modifying those fields.

The reset path does not follow the same discipline. snd_seq_oss_readq_clear(), reached via snd_seq_oss_reset() during an ioctl or release, writes the same fields without any locking. When a user issues an ioctl that resets the queue while another task is reading from the device, the two paths interleave freely. This can leave stale records in the queue, drop freshly queued events, or produce an incorrect readiness result after a wake_up on q->midi_sleep.

Root Cause

The root cause is inconsistent synchronization of shared ring-buffer state. snd_seq_oss_readq_clear() was written to run in a serialized context, but the reset path reaches it without holding q->lock. The enqueue helper snd_seq_oss_readq_put_timestamp() also updates suppression state outside the lock. The fix takes q->lock while clearing the ring and resetting input_time, and refactors the enqueue logic into a caller-locked helper.

Attack Vector

Exploitation requires local access with permission to open an OSS sequencer character device such as /dev/sequencer. A local attacker with those privileges opens the device, issues concurrent read() and reset ioctl() calls from multiple threads, and drives the race. KCSAN traces show one task in snd_seq_oss_readq_free() via odev_read() racing another in snd_seq_oss_readq_clear() via odev_ioctl(), with the shared qlen word observed transitioning 0x00000001 -> 0x00000000 during the race window.

No verified public proof-of-concept code is available. Refer to the upstream fix commits for the exact code paths.

Detection Methods for CVE-2026-80628

Indicators of Compromise

KCSAN reports naming snd_seq_oss_readq_clear and snd_seq_oss_readq_free in dmesg on debug kernels.
Unexpected audio-application errors involving lost or stale MIDI events on hosts using OSS sequencer emulation.
Processes repeatedly issuing ioctl calls against /dev/sequencer in tight loops from unprivileged contexts.

Detection Strategies

Inventory running kernels and compare against fixed versions containing commits 287d506d4e08, 43e10709b1ba, and 49ce92d20782.
Enable KCSAN on test systems to observe the data race path directly during fuzzing of ALSA OSS interfaces.
Correlate telemetry on openat calls to /dev/sequencer and subsequent ioctl activity from non-audio workloads.

Monitoring Recommendations

Alert on unexpected process access to OSS sequencer device nodes on servers where audio subsystems are not required.
Track kernel version drift across the fleet to confirm patched builds are deployed before rebooting.
Review syslog and journal entries for ALSA subsystem warnings following user-space audio activity.

How to Mitigate CVE-2026-80628

Immediate Actions Required

Apply the upstream Linux kernel patch series referenced by commits 287d506, 43e1070, and 49ce92d, or the distribution backport.
On systems that do not need OSS sequencer emulation, unload or blacklist the snd_seq_oss module to remove the vulnerable surface.
Restrict permissions on /dev/sequencer and related nodes to trusted audio groups only.

Patch Information

The fix serializes the reset with q->lock and refactors enqueue logic into a caller-locked helper so snd_seq_oss_readq_put_timestamp() updates suppression state under the same lock. Review the upstream changes at Linux Kernel Change 287d506, Linux Kernel Change 43e1070, and Linux Kernel Change 49ce92d.

Workarounds

Blacklist the snd_seq_oss kernel module on hosts that do not require OSS MIDI sequencer emulation.
Remove or tighten access control lists on /dev/sequencer so only trusted local users can open the device.
Where feasible, disable CONFIG_SND_SEQUENCER_OSS in custom kernel builds until patched kernels are deployed.

bash

# Prevent the vulnerable module from loading until patched kernels are in place
echo "blacklist snd_seq_oss" | sudo tee /etc/modprobe.d/blacklist-snd-seq-oss.conf
sudo rmmod snd_seq_oss 2>/dev/null || true
sudo update-initramfs -u