ALSA: hda: trace PCM open only after assigning a stream (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.18 % · percentile 7 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by static analysis and reviewed with AI-assisted source auditing.
References
- https://git.kernel.org/stable/c/5a4c974dee03cc46eac43c82f33e34ec94f0b348
- https://git.kernel.org/stable/c/fba079ea22822248c82c3a999c88676d05b17bda
- https://git.kernel.org/stable/c/3c6ca6d9342f4a0be7c1413180e11023d13b5cde
- https://git.kernel.org/stable/c/0a52ba6d3b268bb82f0ec4cb861bc68d252369c0
- https://git.kernel.org/stable/c/5c89e7965220e85d06ae4c58adb7d7bb6da2440c
- https://git.kernel.org/stable/c/8477643cb91c9e09ac1b11890eef421ae63e53f7
- https://git.kernel.org/stable/c/3db8afba2d210b7d80cd5cc6b76d7f46daa9b47a
- https://git.kernel.org/stable/c/c9e6e5f38bf75276605f1952b22285f5f3abcaff
European references
- ENISA EUVD · EUVD-2026-93293
- GCVE · GCVE-0-2026-98308
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1374 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 184865085b88789fc8a355cc16ceff25f82f63ba < 5a4c974dee03cc46eac43c82f33e34ec94f0b348 ; affected 184865085b88789fc8a355cc16ceff25f82f63ba < fba079ea22822248c82c3a999c88676d05b17bda ; affected 184865085b88789fc8a355cc16ceff25f82f63ba < 3c6ca6d9342f4a0be7c1413180e11023d13b5cde ; affected 184865085b88789fc8a355cc16ceff25f82f63ba < 0a52ba6d3b268bb82f0ec4cb861bc68d252369c0 ; affected 184865085b88789fc8a355cc16ceff25f82f63ba < 5c89e7965220e85d06ae4c58adb7d7bb6da2440c ; affected 184865085b88789fc8a355cc16ceff25f82f63ba < 8477643cb91c9e09ac1b11890eef421ae63e53f7 |
| Linux · Linux | affected 4.2 ; unaffected 0 < 4.2 ; unaffected 5.10.271 ≤ 5.10.* ; unaffected 5.15.222 ≤ 5.15.* ; unaffected 6.1.189 ≤ 6.1.* ; unaffected 6.6.158 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |