CVE-2026-89980ALSA: harmony: initialize locks before requesting IRQ
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ALSA: harmony: initialize locks before requesting IRQ snd_harmony_create() registers the IRQ before initializing h->lock and h->mixer_lock. A pending interrupt can invoke the handler while these locks are uninitialized. Initialize both locks before requesting the IRQ so the handler always sees valid lock state.
- CVSS
- 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9af6c9203583655cb7ed45e52e14101652b37547; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f86ff9238b0c8284909e073a681a60708b9f36ab; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7dc239edb6d58e01c9ec868565cc03e7adf91747; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9347588bbd6ad43a85e17046d9c117a41453c52a; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 89992bda7dfbba7ded2ba4185730453c57fa65bc; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before cd209eb3136e002becbda232e399fa31a2276436; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 33abb7491e89285a41565670945293dda841afc4 | CNA record |
References
- https://git.kernel.org/stable/c/9af6c9203583655cb7ed45e52e14101652b37547
- https://git.kernel.org/stable/c/f86ff9238b0c8284909e073a681a60708b9f36ab
- https://git.kernel.org/stable/c/7dc239edb6d58e01c9ec868565cc03e7adf91747
- https://git.kernel.org/stable/c/9347588bbd6ad43a85e17046d9c117a41453c52a
- https://git.kernel.org/stable/c/89992bda7dfbba7ded2ba4185730453c57fa65bc
- https://git.kernel.org/stable/c/cd209eb3136e002becbda232e399fa31a2276436
- https://git.kernel.org/stable/c/33abb7491e89285a41565670945293dda841afc4
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.