7.8

CVE-2026-80716: linux

CVSS: 7.8v3.1HighReceived
AliasesUBUNTU-CVE-2026-80716DEBIAN-CVE-2026-80716
Published 28-08-2026Last modified 16-10-2026
Open JSON

Vulnerability summary

CVE-2026-80716 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.8% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.12%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 14 · Related 14
SUSE-SU-2026:24181-1SUSE-SU-2026:24182-1SUSE-SU-2026:4279-1SUSE-SU-2026:4284-1SUSE-SU-2026:4640-1SUSE-SU-2026:4660-1

Timeline

  1. 28-08-2026
    PublishedVulnerability first disclosed.
  2. 16-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink snd_pcm_drain() on a linked stream parks an on-stack wait entry on the drained peer's runtime->sleep, and after schedule_timeout() removes it only if that peer is still found in the caller's group. If group membership changes during the wait and the sleep ends by signal or timeout (so autoremove_wake_function() does not run), finish_wait() is skipped and snd_pcm_drain() returns with the entry still queued on that stream's sleep list; a later wake_up() then walks a freed stack frame. This is reachable by unlinking either the drained or the draining stream. Unlike the close path (snd_pcm_drop() -> snd_pcm_post_stop()), snd_pcm_unlink() never wakes the sleep queues. Wake every group member under the group lock before the membership change, so a linked drainer is released and drops its entry while the streams are still grouped. The window was opened when snd_pcm_link_rwsem stopped being held across the wait and the removal became conditional on group membership (see Fixes). The later switch to finish_wait() kept that conditional removal, so the signal/timeout case remained.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.12%

Chance of exploitation in the next 30 days

Percentile

2%

Versus all other CVEs

30-day change

0.00 pp

From 0.12% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.12%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu165 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.187-1 | < 6.12.105-1 | < 7.1.8-1
  • linux-6.12< 6.12.107-1~deb12u1
Linux1 product
  • linux≥ f57f3df03a8e6010e321fa0258d3e054713c3cb7, < c172e4c53321ee6429955295ea133bc3597a3ca9 | ≥ f57f3df03a8e6010e321fa0258d3e054713c3cb7, < 3035bb784cea3f338934f5042dd3f35225a51b2e | ≥ f57f3df03a8e6010e321fa0258d3e054713c3cb7, < 1c1b7e8e545ce65e40f65b55c432765e058ea98f | ≥ f57f3df03a8e6010e321fa0258d3e054713c3cb7, < e8b784a3f4fba3ea9c4d05138ecfa784a069627f | ≥ f57f3df03a8e6010e321fa0258d3e054713c3cb7, < e8315330e4ec09c0cac625515400e13d0ee22b81 | ≥ f57f3df03a8e6010e321fa0258d3e054713c3cb7, < 2940cc3cf43c72126b74ee6376314c195382023a | ≥ f57f3df03a8e6010e321fa0258d3e054713c3cb7, < db09bc4ab19ce548a078240d2374792523953500 | ≥ f57f3df03a8e6010e321fa0258d3e054713c3cb7, < f495b6c4c8594122918552c9be2b51eb71647cd9 | 5.1

3 vendors · 168 products

References

18 links
Show all 18 references