{
  "cveId": "CVE-2026-80628",
  "url": "https://patchblox.com/security/cve/CVE-2026-80628",
  "summary": "CVE-2026-80628 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-80628, released August 29, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ALSA: seq: oss: Serialize readq reset state with q-\u003Elock",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ALSA: seq: oss: Serialize readq reset state with q-\u003Elock  snd_seq_oss_readq_clear() resets qlen, head, and tail without q-\u003Elock even though the normal reader and producer paths serialize the same ring state under that spinlock. A reset can therefore race snd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and leave stale records in the queue, drop freshly queued ones, or report the wrong readiness after wakeup. KCSAN reports a data race between snd_seq_oss_readq_clear() and snd_seq_oss_readq_free().  Take q-\u003Elock while clearing the ring and resetting input_time. Factor the enqueue logic into a caller-locked helper so snd_seq_oss_readq_put_timestamp() updates its suppression state under the same lock instead of racing the reset path.  The buggy scenario involves two paths, with each column showing the order within that path:  reset path:                      locked readq updater: 1. snd_seq_oss_reset() or        1. A reader or callback producer    release reaches                  takes q-\u003Elock on the same queue.    snd_seq_oss_readq_clear(). 2. snd_seq_oss_readq_clear()     2. The updater tests or modifies    resets qlen, head, tail,         qlen, head, and tail.    and input_time. 3. snd_seq_oss_readq_clear()     3. The updater completes its    wakes sleepers on                read-modify-write sequence.    q-\u003Emidi_sleep. 4. Without q-\u003Elock, the reset    4. The resulting ring state drives    can overlap the locked           later reads and readiness.    update.  KCSAN reports:  BUG: KCSAN: data-race in snd_seq_oss_readq_clear / snd_seq_oss_readq_free  write to 0xffff8881069fe608 of 4 bytes by task 120516 on cpu 0:   snd_seq_oss_readq_free\u002B0x6c/0x80   snd_seq_oss_read\u002B0xcb/0x250   odev_read\u002B0x38/0x60   vfs_read\u002B0xff/0x600   ksys_read\u002B0xb4/0x140   __x64_sys_read\u002B0x46/0x60   do_syscall_64\u002B0xbb/0x2f0   entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f  read to 0xffff8881069fe608 of 4 bytes by task 120517 on cpu 1:   snd_seq_oss_readq_clear\u002B0x1f/0x90   snd_seq_oss_reset\u002B0xa7/0xf0   snd_seq_oss_ioctl\u002B0x6f6/0x7e0   odev_ioctl\u002B0x56/0xc0   __x64_sys_ioctl\u002B0xd1/0x120   do_syscall_64\u002B0xbb/0x2f0   entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f  value changed: 0x00000001 -\u003E 0x00000000",
  "published": "2026-08-28T08:16:47Z",
  "severity": "Low",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00176,
  "epssPercentile": 0.07124,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80628",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.115-2",
      "fix": "DEBIAN-CVE-2026-80628",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-80628",
      "released": "2026-08-29T00:46:20Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.5-1",
      "fix": "DEBIAN-CVE-2026-80628",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-80628",
      "released": "2026-08-29T00:46:20Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}