Description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
Currently we have neither proper check nor protection against the
concurrent calls of PCM hw_params and hw_free ioctls, which may result
in a UAF. Since the existing PCM stream lock can't be used for
protecting the whole ioctl operations, we need a new mutex to protect
those racy calls.
This patch introduced a new mutex, runtime->buffer_mutex, and applies
it to both hw_params and hw_free ioctl code paths. Along with it, the
both functions are slightly modified (the mmap_count check is moved
into the state-check block) for code simplicity.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 2.6.12 | 4.14.279 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 5.17.3-1 | — |
| Debian 13 | linux | 5.17.3-1 | — |
| Debian 12 | linux | 5.17.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-37.39 | — |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1011.14 | — |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1010.12 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1008.12 | — |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1008.10 | — |
| Ubuntu 22.04 LTS | linux-ibm | 5.15.0-1007.8 | — |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1008.11 | — |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1010.11 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1009.12 | — |
| Ubuntu 22.04 LTS | linux-raspi | 5.15.0-1011.13 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux | 5.4.0-124.140 | — |
| Ubuntu 20.04 LTS | linux-aws | 5.4.0-1083.90 | — |
| Ubuntu 20.04 LTS | linux-azure | 5.4.0-1089.94 | — |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1008.9~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-bluefield | 5.4.0-1044.49 | — |
| Ubuntu 20.04 LTS | linux-gcp | 5.4.0-1086.94 | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-hwe-5.15 | 5.15.0-41.44~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-ibm | 5.4.0-1031.35 | — |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1008.11~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-iot | 5.4.0-1004.6 | — |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1073.78 | — |
| Ubuntu 20.04 LTS | linux-lowlatency-hwe-5.15 | 5.15.0-42.45~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1081.89 | — |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1068.78 | — |
| Ubuntu 18.04 LTS | linux | 4.15.0-191.202 | — |
| Ubuntu 18.04 LTS | linux-aws | 4.15.0-1139.150 | — |
| Ubuntu 18.04 LTS | linux-aws-5.4 | 5.4.0-1083.90~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-azure-4.15 | 4.15.0-1149.164 | — |
| Ubuntu 18.04 LTS | linux-azure-5.4 | 5.4.0-1089.94~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp-4.15 | 4.15.0-1134.150 | — |
| Ubuntu 18.04 LTS | linux-gcp-5.4 | 5.4.0-1086.94~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-hwe-5.4 | 5.4.0-124.140~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-ibm-5.4 | 5.4.0-1031.35~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-kvm | 4.15.0-1125.130 | — |
| Ubuntu 18.04 LTS | linux-oracle | 4.15.0-1104.115 | — |
| Ubuntu 18.04 LTS | linux-oracle-5.4 | 5.4.0-1081.89~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-raspi-5.4 | 5.4.0-1068.78~18.04.1 | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1014.14 | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1083.90+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1089.94+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1059.67 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1086.94+fips1 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-aws-fips | 4.15.0-2078.83 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-azure-fips | 4.15.0-2059.65 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips | 4.15.0-1096.107 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-gcp-fips | 4.15.0-2043.48 | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux +2 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux-aws-hwe | 4.15.0-1139.150~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-azure | 4.15.0-1149.164~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-gcp | 4.15.0-1134.150~16.04.2 | — |
| Ubuntu Pro 16.04 LTS | linux-hwe | 4.15.0-191.202~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-oracle | 4.15.0-1104.115~16.04.1 | — |
| Ubuntu Pro 14.04 LTS | linux +2 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux-azure | 4.15.0-1149.164~14.04.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | perf +29 | 5.14.0-162.6.1.el9_1 | RHSA-2022:8267 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.6 TUS | perf +17 | 4.18.0-372.109.1.el8_6 | RHSA-2024:4107 |
| RHEL 8.6 E4S | perf +25 | 4.18.0-372.109.1.el8_6 | RHSA-2024:4107 |
| RHEL 8.6 AUS | perf +17 | 4.18.0-372.109.1.el8_6 | RHSA-2024:4107 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | kernel-64kb +6 | 5.14.21-150500.55.100.1 | SUSE-SU-2025:1241-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.100.1.150500.6.47.1 | SUSE-SU-2025:1241-1 |
| SLES 15 SP4 | kernel-64kb +6 | 5.14.21-150400.24.158.1 | SUSE-SU-2025:1027-1 |
| SLES 15 SP4 | kernel-default-base | 5.14.21-150400.24.158.1.150400.24.78.1 | SUSE-SU-2025:1027-1 |
| SLES 15 SP3 | kernel-64kb +7 | 5.3.18-150300.59.201.1 | SUSE-SU-2025:1263-1 |
| SLES 15 SP3 | kernel-default-base | 5.3.18-150300.59.201.1.150300.18.120.1 | SUSE-SU-2025:1263-1 |
| SLES 12 SP5 | kernel-syms +2 | 4.12.14-122.255.1 | SUSE-SU-2025:1293-1 |
| SLES 11 SP4 | kernel-ec2 +6 | 3.0.101-108.180.1 | SUSE-SU-2026:0385-1, SUSE-SU-2025:0983-1 |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | kernel-default-base | 5.14.21-150500.55.100.1.150500.6.47.1 | SUSE-SU-2025:1241-1 |
| SLES for SAP 15 SP5 | kernel-docs +4 | 5.14.21-150500.55.100.1 | SUSE-SU-2025:1241-1 |
| SLES for SAP 15 SP4 | kernel-default-base | 5.14.21-150400.24.158.1.150400.24.78.1 | SUSE-SU-2025:1027-1 |
| SLES for SAP 15 SP4 | kernel-docs +4 | 5.14.21-150400.24.158.1 | SUSE-SU-2025:1027-1 |
| SLES for SAP 15 SP3 | kernel-default-base | 5.3.18-150300.59.201.1.150300.18.120.1 | SUSE-SU-2025:1263-1 |
| SLES for SAP 15 SP3 | kernel-docs +5 | 5.3.18-150300.59.201.1 | SUSE-SU-2025:1263-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.100.1.150500.6.47.1 | SUSE-SU-2025:1241-1 |
| SLE Micro 5.5 | kernel-rt +1 | 5.14.21-150500.13.91.1 | SUSE-SU-2025:1176-1 |
| SLE Micro 5.5 | kernel-source +1 | 5.14.21-150500.55.100.1 | SUSE-SU-2025:1241-1 |
| SLE Micro 5.4 | kernel-default | 5.14.21-150400.24.158.1 | SUSE-SU-2025:1027-1 |
| SLE Micro 5.4 | kernel-default-base | 5.14.21-150400.24.158.1.150400.24.78.1 | SUSE-SU-2025:1027-1 |
| SLE Micro 5.4 | kernel-rt +1 | 5.14.21-150400.15.115.1 | SUSE-SU-2025:1183-1 |
| SLE Micro 5.3 | kernel-default | 5.14.21-150400.24.158.1 | SUSE-SU-2025:1027-1 |
| SLE Micro 5.3 | kernel-default-base | 5.14.21-150400.24.158.1.150400.24.78.1 | SUSE-SU-2025:1027-1 |
| SLE Micro 5.3 | kernel-rt +1 | 5.14.21-150400.15.115.1 | SUSE-SU-2025:1183-1 |
| SLE Micro 5.2 | kernel-default | 5.3.18-150300.59.201.1 | SUSE-SU-2025:1263-1 |
| SLE Micro 5.2 | kernel-default-base | 5.3.18-150300.59.201.1.150300.18.120.1 | SUSE-SU-2025:1263-1 |
| SLE Micro 5.2 | kernel-rt +1 | 5.3.18-150300.205.1 | SUSE-SU-2025:1194-1 |
| SLE Micro 5.1 | kernel-default | 5.3.18-150300.59.201.1 | SUSE-SU-2025:1263-1 |
| SLE Micro 5.1 | kernel-default-base | 5.3.18-150300.59.201.1.150300.18.120.1 | SUSE-SU-2025:1263-1 |
| SLE Micro 5.1 | kernel-rt +1 | 5.3.18-150300.205.1 | SUSE-SU-2025:1194-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.100.1 | SUSE-SU-2025:1241-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_25 | 1-150500.11.3.1 | SUSE-SU-2025:1241-1 |
| SLE Live Patching 15 SP4 | kernel-default | 5.14.21-150400.24.158.1 | SUSE-SU-2025:1027-1 |
| SLE Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_38 | 1-150400.9.3.1 | SUSE-SU-2025:1027-1 |
| SLE Live Patching 15 SP3 | kernel-default | 5.3.18-150300.59.201.1 | SUSE-SU-2025:1263-1 |
| SLE Live Patching 15 SP3 | kernel-livepatch-SLE15-SP3_Update_56 | 1-150300.7.3.1 | SUSE-SU-2025:1263-1 |
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.255.1 | SUSE-SU-2025:1293-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_67 | 1-8.5.1 | SUSE-SU-2025:1293-1 |
| SLE HPC 15 SP5 | kernel-64kb +5 | 5.14.21-150500.55.100.1 | SUSE-SU-2025:1241-1 |
| SLE HPC 15 SP5 | kernel-default-base | 5.14.21-150500.55.100.1.150500.6.47.1 | SUSE-SU-2025:1241-1 |
| SLE HPC 15 SP4 | kernel-64kb +5 | 5.14.21-150400.24.158.1 | SUSE-SU-2025:1027-1 |
| SLE HPC 15 SP4 | kernel-default-base | 5.14.21-150400.24.158.1.150400.24.78.1 | SUSE-SU-2025:1027-1 |
| SLE HPC 15 SP3 | kernel-64kb +6 | 5.3.18-150300.59.201.1 | SUSE-SU-2025:1263-1 |
| SLE HPC 15 SP3 | kernel-default-base | 5.3.18-150300.59.201.1.150300.18.120.1 | SUSE-SU-2025:1263-1 |
| SUSE Manager Server 4.3 | kernel-default-base | 5.14.21-150400.24.158.1.150400.24.78.1 | SUSE-SU-2025:1027-1 |
| SUSE Manager Server 4.3 | kernel-syms +3 | 5.14.21-150400.24.158.1 | SUSE-SU-2025:1027-1 |
| SUSE Manager Proxy 4.3 | kernel-default-base | 5.14.21-150400.24.158.1.150400.24.78.1 | SUSE-SU-2025:1027-1 |
| SUSE Manager Proxy 4.3 | kernel-syms +2 | 5.14.21-150400.24.158.1 | SUSE-SU-2025:1027-1 |
| SUSE Enterprise Storage 7.1 | kernel-64kb +6 | 5.3.18-150300.59.201.1 | SUSE-SU-2025:1263-1 |
| SUSE Enterprise Storage 7.1 | kernel-default-base | 5.3.18-150300.59.201.1.150300.18.120.1 | SUSE-SU-2025:1263-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | kernel-livepatch-4.14.281-212.502 | 1.0-0.amzn2 | ALAS2-2022-1798 |
| Amazon Linux 2 | perf +8 | 4.14.281-212.502.amzn2 | ALAS2-2022-1798 |
Advisories 12
- RHSA-2022:8267 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2024:4107 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- SUSE-SU-2026:0385-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:1194-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:1176-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:1241-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:1027-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:1183-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0983-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:1293-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2022-1798 Important: kernel security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 2, 2025
- SUSE-SU-2025:1263-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Apr 16, 2025
References
- https://git.kernel.org/stable/c/a42aa926843acca96c0dfbde2e835b8137f2f092
- https://git.kernel.org/stable/c/9cb6c40a6ebe4a0cfc9d6a181958211682cffea9
- https://git.kernel.org/stable/c/fbeb492694ce0441053de57699e1e2b7bc148a69
- https://git.kernel.org/stable/c/0f6947f5f5208f6ebd4d76a82a4757e2839a23f8
- https://git.kernel.org/stable/c/33061d0fba51d2bf70a2ef9645f703c33fe8e438
- https://git.kernel.org/stable/c/0090c13cbbdffd7da079ac56f80373a9a1be0bf8
- https://git.kernel.org/stable/c/1bbf82d9f961414d6c76a08f7f843ea068e0ab7b
- https://git.kernel.org/stable/c/92ee3c60ec9fe64404dc035e7c41277d74aa26cb