HIGH Introduced in 3.18
pcxhr ThreadedIRQ Race
CVE-2026-80967
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI4.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcxhr: initialize mutexes before requesting threaded IRQ pcxhr_probe() requests pcxhr_threaded_irq() before initializing mgr->lock, even though the threaded handler takes that mutex. Initialize the manager locks before request_threaded_irq() so an early interrupt cannot run against uninitialized mutex state during probe.
02KernelScan AI Analysis
Risk summary
A race condition during probe of the ALSA pcxhr driver can cause a kernel crash when an interrupt fires before a mutex is initialized. The bug requires local access to trigger device probe, and the timing window is narrow.
Vulnerability analysis
During driver initialization for Digigram pcxhr PCI audio devices, the driver registers an interrupt handler before initializing the mutexes that handler uses. If a device interrupt arrives in this narrow window, the threaded interrupt handler will attempt to lock an uninitialized mutex, causing undefined behavior and typically a kernel crash. The fix moves the mutex initialization earlier in the probe sequence, before the interrupt is requested. An attacker with the ability to cause device probe (loading the driver or inserting the hardware) can trigger this condition.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 3.18 | 5.15.221 | 039602d6ddb1 |
| 6.1 | 3.18 | 6.1.188 | a5f405adb022 |
| 6.12 | 3.18 | 6.12.109 | c069b3cfd753 |
| 6.18 | 3.18 | 6.18.50 | 7ef9ad82d95d |
| 6.6 | 3.18 | 6.6.157 | ede25b7fea0d |
| 7.2 | 3.18 | 7.2.4 | 7cf280fbef5d |
| mainline | 3.18 | 7.3 | 6c97817e2059 |
| cip/6.1 | 3.18 | 6.1.189-cip61 | a5f405adb022 |
| cip/6.1-rt | 3.18 | 6.1.189-cip61-rt32 | a5f405adb022 |
| cip/6.12 | 3.18 | 6.12.111-cip32 | c069b3cfd753 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |