CVE-2026-46157

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Pulse Code Modulation (PCM) Open Sound System (OSS) subsystem. A data race vulnerability exists due to concurrent access to the runtime.oss.trigger field without proper protection. This unprotected access can lead to the overwriting of other bit fields, which may confuse the system's operation and potentially lead to integrity issues or denial of service.

This vulnerability is rated as Moderate because exploitation requires local access and concurrent execution against audio devices, primarily resulting in kernel instability or denial of service rather than arbitrary code execution. The issue exists in the legacy ALSA Open Sound System (OSS) emulation layer, which is disabled by default in standard Red Hat Enterprise Linux kernels. Consequently, default installations without custom audio emulation configurations remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.