CVE-2026-46157 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Currently the runtime.oss.trigger field may be accessed concurrently without protection, which may lead to the data race. And, in this case, it may lead to more severe problem because it's a bit field; as writing the data, it may overwrite other bit fields as well, which confuses the operation completely, as spotted by fuzzing. Fix it by covering runtime.oss.trigger bit fled also with the existing params_lock mutex in both snd_pcm_oss_get_trigger() and snd_pcm_oss_poll().
A data race vulnerability has been identified in the Linux kernel's Advanced Linux Sound Architecture (ALSA) component, specifically within the PCM OSS (Open Sound System) interface. The issue arises because the 'runtime.oss.trigger' field can be accessed concurrently without proper synchronization, potentially leading to a data race. This vulnerability is particularly concerning as the 'trigger' field is a bit field, allowing a write operation to inadvertently overwrite other bit fields, thereby disrupting the intended functionality. This issue was discovered through fuzz testing. The vulnerability affects several versions of the Linux kernel.
The vulnerability has been addressed by modifying the PCM OSS implementation to include proper synchronization. The 'runtime.oss.trigger' field is now protected by the 'params_lock' mutex, ensuring that concurrent access does not lead to a data race. Users should upgrade to the latest stable version of the Linux kernel where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/49f9d048845be874df7997e4b1ce662de450c4b6 | kernel.org | Patch |
| https://git.kernel.org/stable/c/6b01c1bc9a4748ab37548a700a8aaff910e298e6 | kernel.org | Patch |
| https://git.kernel.org/stable/c/901ac0ff15edf9503162e2cf6579bd11a30f1ed4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ac3e9b55b7da6f0be51720bd330a0edc1a8b61f1 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.12.1, < 6.12.88 >= 6.13, < 6.18.30 >= 6.19, < 7.0.7 2.6.12 - 2.6.12 rc2 2.6.12 rc3 2.6.12 rc4 2.6.12 rc5 7.1 rc1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 9, 2026 | Initial Analysis | [email protected] |
| May 30, 2026 | CVE Modified | kernel.org |
| May 28, 2026 | New CVE Received | kernel.org |