CVE-2026-89979

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Pulse Code Modulation (PCM) subsystem. A race condition exists where a thread can initiate a PCM start operation while another thread is performing non-atomic PCM operations, such as hardware parameter setup or preparation. This timing issue can lead to system inconsistencies and debugging warnings, potentially affecting audio processing stability.

This vulnerability is rated as Low severity because triggering the race condition requires local access to ALSA sound devices, and the resulting impact is limited to kernel debug warnings and minor state inconsistencies rather than privilege escalation or persistent system compromise. In typical enterprise server environments, sound hardware is either absent or unconfigured for non-privileged users, substantially limiting exposure. Furthermore, standard container workloads are insulated by default since host audio devices are not passed through to container namespaces.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.