EUVD-2026-80580
GHSA-w4v8-wqj5-pmgx
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local probe-time race requiring privileged module load/boot (PR:H) and precise interrupt timing (AC:H); no confidentiality/integrity impact, availability crash only (A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
8DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ALSA: harmony: initialize locks before requesting IRQ
snd_harmony_create() registers the IRQ before initializing h->lock and h->mixer_lock. A pending interrupt can invoke the handler while these locks are uninitialized.
Initialize both locks before requesting the IRQ so the handler always sees valid lock state.
AnalysisAI
Uninitialized spinlock use in the Linux kernel's ALSA 'harmony' driver (HP PA-RISC CS4215 sound hardware) can crash the system during driver initialization, because snd_harmony_create() calls request_irq() before h->lock and h->mixer_lock are initialized and a pending interrupt can fire the handler against garbage lock state. Only systems with this legacy driver present and probing on real or emulated PA-RISC hardware are exposed, and triggering it requires a narrow hardware timing window during boot or root-privileged module load, so there is no public exploit identified at time of analysis and independent assessment rates real-world risk as low despite the vendor's 8.4 (HIGH) score - the assessed impact is availability-only (local denial of service/crash) under a privileged, high-complexity precondition. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the specific HP PA-RISC 'Harmony' (CS4215) ALSA sound driver to be present and probing on real or emulated PA-RISC hardware; the flaw only triggers if an interrupt is pending/asserted in the narrow window during snd_harmony_create() after request_irq() but before h->lock and h->mixer_lock are initialized. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-real-world-risk issue despite the vendor's inflated 8.4 (HIGH) CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to Linux 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5, or mainline 7.3-rc2 (or later), which contain the upstream fix moving h->lock and h->mixer_lock initialization ahead of request_irq() - see the kernel.org stable commits linked from https://nvd.nist.gov/vuln/detail/CVE-2026-89980 and https://git.kernel.org/stable/c/9af6c9203583655cb7ed45e52e14101652b37547. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory any HP PA-RISC systems, physical or emulated, that load the ALSA 'harmony' (CS4215) driver during boot, and confirm whether they are receiving kernel updates through your normal patch pipeline. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with alsa-plugins 1.1.7 and later) has a "
A race condition in the Linux kernel ALSA PCM (sound) subsystem allows a local, authenticated user with access to a soun
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today