CVE-2026-80967

A flaw was found in the ALSA pcxhr driver within the Linux kernel. The pcxhr_probe() function requests a threaded interrupt before properly initializing a critical mutex (mgr->lock). This oversight could allow an early interrupt to operate on an uninitialized mutex, potentially leading to system instability or a denial of service (DoS) condition. A local attacker could potentially exploit this to impact system availability.

This low-impact flaw in the Linux kernel ALSA pcxhr driver affects Red Hat Enterprise Linux (kernel and kernel-rt) and the OpenShift Container Platform RHCOS images that ship the kernel. The pcxhr_probe() function registers a threaded interrupt handler before initializing the mgr->lock mutex that the handler takes, so an early interrupt during device probe can run against uninitialized mutex state. The consequence is limited to system availability: system instability or a kernel panic during probing of the affected audio hardware, i.e. a local denial of service. Reliable exploitation is difficult because it requires winning the race between interrupt delivery and mutex initialization during driver probe on a system with the hardware present. Red Hat rates this flaw Low severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the upstream CVEORG rating is 8.4 (IMPORTANT); the difference reflects Red Hat's assessment that only availability is impacted and that the probe-time race is hard to trigger deterministically. Fixes for the affected Red Hat Enterprise Linux and OpenShift streams are deferred because the flaw falls below the severity threshold used to file fix trackers, leaving a residual, low-likelihood risk of probe-time system instability on systems with the affected hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.