CVE-2026-80716: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80716 Overview

CVE-2026-80716 is a use-after-free vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Pulse Code Modulation (PCM) subsystem. The flaw resides in snd_pcm_drain() handling of linked streams. When a drain waiter parks an on-stack wait entry on a peer's runtime->sleep list and the wait ends by signal or timeout, finish_wait() is skipped if group membership changed during the wait. A subsequent wake_up() then walks a freed stack frame, corrupting kernel memory.

Critical Impact
A local authenticated user can trigger memory corruption in the kernel's ALSA PCM code path, enabling privilege escalation or denial of service on affected Linux systems.

Affected Products

Linux kernel (upstream stable trees, multiple versions containing the affected snd_pcm_link_rwsem refactor)
Distributions shipping vulnerable kernels with ALSA PCM support enabled
Systems exposing /dev/snd/pcm* device nodes to unprivileged users through the audio group

Discovery Timeline

2026-08-28 - CVE-2026-80716 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80716

Vulnerability Analysis

The vulnerability affects the ALSA PCM linked-stream drain path in the Linux kernel sound subsystem. snd_pcm_drain() on a linked stream allocates a wait_queue_entry on the caller's stack and enqueues it on the drained peer's runtime->sleep wait queue. After schedule_timeout() returns, the entry is removed only if the peer remains in the caller's link group.

If snd_pcm_unlink() mutates group membership during the wait and the sleep terminates by signal or timeout, autoremove_wake_function() never runs. The conditional check then bypasses finish_wait(), leaving a dangling wait entry pointing to the now-returned stack frame. Any subsequent wake_up() on that sleep list dereferences freed stack memory, producing an exploitable use-after-free [CWE-416].

Root Cause

The defect was introduced when snd_pcm_link_rwsem was no longer held across the wait, making removal of the wait entry conditional on group membership. Unlike the close path (snd_pcm_drop() and snd_pcm_post_stop()), snd_pcm_unlink() did not wake pending sleep queues before altering membership. The later switch to finish_wait() preserved the conditional removal, so the signal and timeout paths remained racy.

Attack Vector

Exploitation requires local access and permission to open PCM device nodes. An attacker opens two PCM streams, links them with SNDRV_PCM_IOCTL_LINK, invokes SNDRV_PCM_IOCTL_DRAIN on one, and races an unlink from a second thread while delivering a signal to abort the drain. See the upstream fix commits referenced below for the code paths involved.

No verified public proof-of-concept code is available.
Refer to kernel commits e8315330, 1c1b7e8e, 2940cc3c, 3035bb78,
c172e4c5, db09bc4a, e8b784a3, and f495b6c4 for the patch details.

Detection Methods for CVE-2026-80716

Indicators of Compromise

Kernel oops or panic messages referencing snd_pcm_drain, __wake_up_common, or try_to_wake_up with fault addresses on kernel stacks.
Unexpected process crashes or SIGKILL delivery to audio-using processes coinciding with PCM ioctl activity.
Presence of KASAN or slab-use-after-free reports naming the ALSA PCM subsystem in kernel logs.

Detection Strategies

Audit syscall and ioctl telemetry for repeated SNDRV_PCM_IOCTL_LINK, SNDRV_PCM_IOCTL_UNLINK, and SNDRV_PCM_IOCTL_DRAIN sequences from the same non-root user.
Enable KASAN on test kernels to surface the use-after-free reliably during triage.
Correlate audio device access with signal delivery patterns targeting drain operations.

Monitoring Recommendations

Forward dmesg and journald kernel logs to a central log platform and alert on ALSA-related BUG or WARN entries.
Track membership of the audio group and unexpected additions of interactive user accounts.
Monitor for privilege escalation indicators such as new SUID binaries or unexpected UID transitions following audio subsystem activity.

How to Mitigate CVE-2026-80716

Immediate Actions Required

Apply the upstream kernel patches referenced in the fix commits and rebuild or update the affected kernel image.
Restart systems after kernel update to load the patched image; live patching where available may cover this fix.
Restrict membership of the audio group to trusted local users to reduce attack surface.

Patch Information

The fix wakes every group member under the group lock before membership changes, ensuring a linked drainer is released and removes its wait entry while streams are still grouped. Backports are available across stable branches in the following commits: 1c1b7e8e, 2940cc3c, 3035bb78, c172e4c5, db09bc4a, e8315330, e8b784a3, and f495b6c4.

Workarounds

Blacklist the snd_pcm module on systems that do not require audio playback or capture.
Remove untrusted local accounts from the audio group and tighten permissions on /dev/snd/*.
Disable PCM linking in userspace audio stacks where feasible until patched kernels are deployed.

bash

# Remove user from audio group and verify /dev/snd permissions
sudo gpasswd -d <username> audio
ls -l /dev/snd/

# Optional: prevent snd_pcm from loading on headless servers
echo 'blacklist snd_pcm' | sudo tee /etc/modprobe.d/disable-snd-pcm.conf
sudo update-initramfs -u