{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-80716",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-80716",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-08-28T06:53:14.286Z",
    "updatedAt": "2026-10-16T19:26:34.951Z",
    "importedAt": "2026-10-24T01:58:30.346Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "ALSA: pcm: wake linked drain waiters on unlink",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: wake linked drain waiters on unlink\n\nsnd_pcm_drain() on a linked stream parks an on-stack wait entry on the\ndrained peer's runtime->sleep, and after schedule_timeout() removes it\nonly if that peer is still found in the caller's group.  If group\nmembership changes during the wait and the sleep ends by signal or\ntimeout (so autoremove_wake_function() does not run), finish_wait() is\nskipped and snd_pcm_drain() returns with the entry still queued on that\nstream's sleep list; a later wake_up() then walks a freed stack frame.\nThis is reachable by unlinking either the drained or the draining stream.\n\nUnlike the close path (snd_pcm_drop() -> snd_pcm_post_stop()),\nsnd_pcm_unlink() never wakes the sleep queues.  Wake every group member\nunder the group lock before the membership change, so a linked drainer is\nreleased and drops its entry while the streams are still grouped.\n\nThe window was opened when snd_pcm_link_rwsem stopped being held across\nthe wait and the removal became conditional on group membership (see\nFixes). The later switch to finish_wait() kept that conditional removal,\nso the signal/timeout case remained.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "status": "affected",
              "versionType": "git",
              "lessThan": "c172e4c53321ee6429955295ea133bc3597a3ca9"
            },
            {
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "status": "affected",
              "versionType": "git",
              "lessThan": "3035bb784cea3f338934f5042dd3f35225a51b2e"
            },
            {
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "status": "affected",
              "versionType": "git",
              "lessThan": "1c1b7e8e545ce65e40f65b55c432765e058ea98f"
            },
            {
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "status": "affected",
              "versionType": "git",
              "lessThan": "e8b784a3f4fba3ea9c4d05138ecfa784a069627f"
            },
            {
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "status": "affected",
              "versionType": "git",
              "lessThan": "e8315330e4ec09c0cac625515400e13d0ee22b81"
            },
            {
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "status": "affected",
              "versionType": "git",
              "lessThan": "2940cc3cf43c72126b74ee6376314c195382023a"
            },
            {
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "status": "affected",
              "versionType": "git",
              "lessThan": "db09bc4ab19ce548a078240d2374792523953500"
            },
            {
              "version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
              "status": "affected",
              "versionType": "git",
              "lessThan": "f495b6c4c8594122918552c9be2b51eb71647cd9"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "5.1",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "5.1"
            },
            {
              "version": "5.10.265",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "version": "5.15.216",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.183",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.151",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.103",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.44",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.1.8",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "version": "7.2",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}