CVE-2026-98308
Description
A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) High Definition Audio (HDA) subsystem. A local user can cause a denial of service (DoS) by attempting to open audio streams when hardware streams are exhausted. Because the controller driver invokes an event trace before verifying whether a stream was successfully allocated, it accesses an unassigned stream pointer, leading to a null pointer dereference and a system crash.
Statement
A low impact denial of service flaw was found in the Linux kernel's ALSA High Definition Audio (HDA) subsystem, affecting the kernel packages in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases built on RHEL CoreOS 9. When a local user attempts to open an ALSA PCM audio stream while all hardware streams are exhausted, the HDA controller driver invokes the trace_azx_pcm_open tracepoint before checking whether a stream was successfully assigned, and the tracepoint payload dereferences the unassigned NULL stream pointer, causing a NULL pointer dereference that crashes the kernel. Red Hat Enterprise Linux 6, 7, and 8 (including their kernel-rt variants) and OpenShift Container Platform 4 releases based on RHEL CoreOS 8 are not affected because the vulnerable code is not present. Although the Red Hat CVSS 3.1 score is 5.5 (moderate), Red Hat rates the impact of this flaw as low because triggering it requires the ALSA HDA tracepoint to be actively enabled, which is not the default configuration, in addition to exhaustion of all available hardware streams. Because of this limited practical exposure, fixes for the affected product streams have been deferred; the residual risk is a local denial of service limited to systems on which HDA tracing has been explicitly enabled.
Mitigation
The vulnerable code path is only reached when the ALSA HDA tracepoint is actively enabled, which is not the default configuration. As a workaround, keep the hda trace_azx_pcm_open tracepoint disabled; avoid enabling ALSA HDA tracing (for example via tracefs) on affected systems, as keeping this tracepoint disabled prevents the NULL pointer dereference. Apart from this workaround, no other mitigation is currently available other than updating to a kernel build that contains the fix once it is released for the affected streams.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
