HIGH Introduced in 2.6.12
alsa Harmony Lock Deref
CVE-2026-89980
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI4.0MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: harmony: initialize locks before requesting IRQ snd_harmony_create() registers the IRQ before initializing h->lock and h->mixer_lock. A pending interrupt can invoke the handler while these locks are uninitialized. Initialize both locks before requesting the IRQ so the handler always sees valid lock state.
02KernelScan AI Analysis
Risk summary
A race condition in the ALSA harmony audio driver allows an interrupt handler to execute before spinlocks are initialized, leading to use of uninitialized lock state and potential kernel crash. The vulnerability requires access to a PA-RISC system with the harmony audio hardware, limiting practical exploitability.
Vulnerability analysis
The driver enables interrupts before its internal locks are ready to use. If the hardware delivers an interrupt during this window, the kernel tries to acquire a lock that has not been set up, causing a crash or system hang. The fix prepares the locks before enabling interrupts so the handler always finds valid state. The flaw is only present on PA-RISC machines with this audio hardware, and only during the brief driver startup period.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 2.6.12 | 5.15.221 | 9af6c9203583 |
| 6.1 | 2.6.12 | 6.1.188 | f86ff9238b0c |
| mainline | 2.6.12 | 7.3-rc2 | 33abb7491e89 |
| 6.6 | 2.6.12 | 6.6.157 | 7dc239edb6d5 |
| 6.18 | 2.6.12 | 6.18.51 | 89992bda7dfb |
| 6.12 | 2.6.12 | 6.12.110 | 9347588bbd6a |
| 7.2 | 2.6.12 | 7.2.5 | cd209eb3136e |
| cip/6.12 | 2.6.12 | 6.12.111-cip32 | 9347588bbd6a |