CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger

Synopsis

A data race vulnerability exists in the Linux kernel's ALSA PCM OSS subsystem, specifically in how the runtime.oss.trigger bit field is accessed concurrently without mutex protection. The flaw is reachable locally by an attacker who already holds a low-privilege account on the host, requiring no network access and no user interaction, as reflected in the CVSS vector (AV:L/PR:L/UI:N). Successful exploitation corrupts shared kernel state, giving an attacker the ability to read protected memory, tamper with kernel data, or crash the system. Patched kernel versions 6.12.88, 6.18.30, and the associated upstream commits are available, and a patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the vulnerable component is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no elevated or administrative credentials are needed to reach the vulnerable code path.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the race condition entirely through their own process.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race-window timing beyond what the unprotected bit-field access itself creates, nor on specific memory layout conditions.

Blast Radius

• An attacker reads protected kernel memory, which may expose session tokens, credentials, or other sensitive data held in kernel structures.
• Corrupted bit-field writes allow an attacker to tamper with adjacent kernel state fields, altering PCM device behavior or broader ALSA subsystem behavior.
• Kernel state corruption can cause an unrecoverable fault, crashing the affected host and taking down all workloads running on it.
• Because the affected code sits in a shared kernel subsystem, corruption is not isolated to the triggering process and may affect other processes sharing the same audio device context.