Linux Kernel CVE-2026-53242

The vulnerability lives in the Linux kernel's ALSA (Advanced Linux Sound Architecture) PCM core, specifically the draining logic (snd_pcm_drain()) used to flush pending audio on playback streams. Linux supports linking multiple PCM substreams into a synchronized group via the SNDRV_PCM_IOCTL_LINK ioctl, and drain iterates over the group sleeping on each substream's runtime sleep wait queue. The root cause is a race-prone misuse of the kernel wait-queue API: init_waitqueue_entry() does not reset the entry's list prev/next pointers, and the conditional remove_wait_queue() is bypassed when the substream being checked (to_check) is removed from the group by a concurrent UNLINK. The stale wait entry then remains queued on the unlinked substream while a later add_wait_queue() re-inserts it onto another queue, splicing two linked lists together. A subsequent wake_up walks the corrupted list and dereferences offset 0 of a wait_queue_head_t - actually a spinlock - as a function pointer, panicking the kernel. While the input has no assigned CWE, this is a classic concurrency/use-after-state-change (race condition leading to memory list corruption, CWE-362/CWE-416 family). The fix replaces the manual primitives with init_wait_entry()/prepare_to_wait()/finish_wait(), where init_wait_entry() re-initializes list pointers each iteration via INIT_LIST_HEAD and installs autoremove_wake_function(), and finish_wait() correctly handles both queued and already-removed entries.