CVE-2026-80628 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should care about this vulnerability because it can potentially lead to a denial of service or arbitrary code execution. The affected operators are Linux kernel developers and maintainers. The affected platforms are Linux-based systems. The vulnerability-management impact is that patches should be applied to address this vulnerability. The security-team impact is that security teams should review and apply patches to address this vulnerability and monitor Linux kernel logs for potential exploitation attempts. Additionally, compensating controls such as monitoring and asset inventory should be reviewed and updated to ensure that exposed systems are properly secured. Rollback/change windows and source tracking should also be considered to ensure that any changes to the system are properly tracked and verified. The recommended actions include applying Linux kernel updates, reviewing and updating Linux kernel configurations, and monitoring Linux kernel logs for potential exploitation attempts. The defensive priority is to apply Linux kernel updates to address this vulnerability. Evidence notes include the Linux kernel ALSA sequencer OSS implementation has a data race vulnerability. The vulnerability exists in the snd_seq_oss_readq_clear() function, which resets the read queue without acquiring the q->lock spinlock. This can cause a race with the snd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() functions, leading to stale records in the queue, dropped queued events, or incorrect readiness reporting. The source grounding is based on the official CVE Program record and the NIST NVD detail page. The evidence limits are based on the information provided in the CVE record and the NVD detail page. The known and unknown affected scope is limited to the Linux kernel ALSA sequencer OSS implementation. Defenders should verify that patches have been applied and that Linux kernel logs are being monitored for potential exploitation attempts. Compensating controls such as monitoring and asset inventory should be reviewed and updated to ensure that exposed systems are The

Technical summary

The Linux kernel ALSA sequencer OSS implementation has a data race vulnerability. The vulnerability exists in the snd_seq_oss_readq_clear() function, which resets the read queue without acquiring the q->lock spinlock. This can cause a race with the snd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() functions, leading to stale records in the queue, dropped queued events, or incorrect readiness reporting.

Defensive priority

Apply Linux kernel updates to address data race vulnerability in ALSA sequencer OSS implementation.

Recommended defensive actions

• Apply Linux kernel updates to address CVE-2026-80628
• Review and update Linux kernel configurations to ensure ALSA sequencer OSS is properly secured
• Monitor Linux kernel logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The Linux kernel ALSA sequencer OSS implementation has a data race vulnerability. The vulnerability exists in the snd_seq_oss_readq_clear() function, which resets the read queue without acquiring the q->lock spinlock. This can cause a race with the snd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() functions, leading to stale records in the queue, dropped queued events, or incorrect readiness reporting.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.