CVE-2026-89980

ALSA: harmony: initialize locks before requesting IRQ

State: Published
Severity: 8.4 High
Published: Sep 16, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: harmony: initialize locks before requesting IRQ

snd_harmony_create() registers the IRQ before initializing h->lock and h->mixer_lock. A pending interrupt can invoke the handler while these locks are uninitialized.

Initialize both locks before requesting the IRQ so the handler always sees valid lock state.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 00fee94390e90c2e4db0a502bd1e2ea7f0b795b9Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9af6c9203583655cb7ed45e52e14101652b37547Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f86ff9238b0c8284909e073a681a60708b9f36abAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7dc239edb6d58e01c9ec868565cc03e7adf91747Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9347588bbd6ad43a85e17046d9c117a41453c52aAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 89992bda7dfbba7ded2ba4185730453c57fa65bcAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cd209eb3136e002becbda232e399fa31a2276436Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 33abb7491e89285a41565670945293dda841afc4Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.273 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 00fee94390e90c2e4db0a502bd1e2ea7f0b795b9Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9af6c9203583655cb7ed45e52e14101652b37547Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f86ff9238b0c8284909e073a681a60708b9f36abAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7dc239edb6d58e01c9ec868565cc03e7adf91747Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9347588bbd6ad43a85e17046d9c117a41453c52aAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 89992bda7dfbba7ded2ba4185730453c57fa65bcAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cd209eb3136e002becbda232e399fa31a2276436Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 33abb7491e89285a41565670945293dda841afc4Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.273 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.