CVE-2026-98308

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) High Definition Audio (HDA) subsystem. A local user can cause a denial of service (DoS) by attempting to open audio streams when hardware streams are exhausted. Because the controller driver invokes an event trace before verifying whether a stream was successfully allocated, it accesses an unassigned stream pointer, leading to a null pointer dereference and a system crash.

A low impact denial of service flaw was found in the Linux kernel's ALSA High Definition Audio (HDA) subsystem, affecting the kernel packages in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases built on RHEL CoreOS 9. When a local user attempts to open an ALSA PCM audio stream while all hardware streams are exhausted, the HDA controller driver invokes the trace_azx_pcm_open tracepoint before checking whether a stream was successfully assigned, and the tracepoint payload dereferences the unassigned NULL stream pointer, causing a NULL pointer dereference that crashes the kernel. Red Hat Enterprise Linux 6, 7, and 8 (including their kernel-rt variants) and OpenShift Container Platform 4 releases based on RHEL CoreOS 8 are not affected because the vulnerable code is not present. Although the Red Hat CVSS 3.1 score is 5.5 (moderate), Red Hat rates the impact of this flaw as low because triggering it requires the ALSA HDA tracepoint to be actively enabled, which is not the default configuration, in addition to exhaustion of all available hardware streams. Because of this limited practical exposure, fixes for the affected product streams have been deferred; the residual risk is a local denial of service limited to systems on which HDA tracing has been explicitly enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The vulnerable code path is only reached when the ALSA HDA tracepoint is actively enabled, which is not the default configuration. As a workaround, keep the hda trace_azx_pcm_open tracepoint disabled; avoid enabling ALSA HDA tracing (for example via tracefs) on affected systems, as keeping this tracepoint disabled prevents the NULL pointer dereference. Apart from this workaround, no other mitigation is currently available other than updating to a kernel build that contains the fix once it is released for the affected streams.