In the Linux kernel, the following vulnerability has been resolved:
ALSA: PCM: Fix wait queue list corruption in sndpcmdrain() on linked streams
sndpcmdrain() uses initwaitqueueentry which does not clear entry.prev/next, and addwaitqueue with a conditional removewaitqueue that is skipped when tocheck is no longer in the group after concurrent UNLINK. The orphaned wait entry remains on the unlinked substream sleep queue. On the next drain iteration, addwaitqueue adds the entry to a new queue while still linked on the old one, corrupting both lists. A subsequent wakeup dereferences NULL at the func pointer (mapped from the spinlock at offset 0 of the misinterpreted waitqueuehead_t), causing a kernel panic.
Replace initwaitqueueentry/addwaitqueue/conditional removewaitqueue with initwaitentry/preparetowait/ finishwait. initwaitentry clears prev/next via INITLISTHEAD on each iteration and sets autoremovewakefunction which auto-removes the entry on wake-up. finishwait safely handles both the already-removed and still-queued cases.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53242.json",
"cna_assigner": "Linux"
}