CVE-2026-80716

A flaw was found in the Linux kernel. Specifically, in the Advanced Linux Sound Architecture (ALSA) Pulse-Code Modulation (PCM) subsystem, a use-after-free vulnerability exists. This occurs when a linked stream is unlinked, and a wait entry is not properly removed from the drained peer's sleep list. A local attacker could exploit this to cause a system crash (denial of service) or potentially execute arbitrary code by accessing a freed memory location.

This vulnerability is evaluated with a Moderate impact for Red Hat Enterprise Linux because exploitation requires local unprivileged access to ALSA audio devices and relies on tight race conditions during PCM stream drainage. Default enterprise server environments typically do not configure audio hardware or expose sound interfaces to untrusted users. A successful exploit could lead to a kernel crash or privilege escalation, but attack complexity remains high due to specific timing and device access constraints.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.