Use-after-free in Linux kernel - CVE-2026-80716

Vulnerability identifier: #VU146061

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-80716

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in snd_pcm_drain() and snd_pcm_unlink() in the ALSA PCM subsystem when unlinking a drained or draining linked stream while a drain wait is pending. A local user can trigger stream unlinking to cause a denial of service.

The issue occurs when group membership changes during the wait and the wait ends by signal or timeout, leaving an on-stack wait entry queued on a sleep list.

Linux kernel
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Availability Extension 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Live Patching
kernel-livepatch-5_14_21-150400_24_240-default-debuginfo
kernel-livepatch-5_14_21-150400_24_240-default
kernel-livepatch-SLE15-SP4_Update_59-debugsource
kernel-source-rt
kernel-rt-debugsource
kernel-rt-debuginfo
kernel-rt
kernel-obs-build
kernel-docs
kernel-devel
kernel-macros
kernel-syms
kernel-obs-build-debugsource
kernel-source
ocfs2-kmp-default-debuginfo
kernel-default
reiserfs-kmp-default-debuginfo
kernel-default-debugsource
kernel-zfcpdump-debugsource
kernel-zfcpdump-debuginfo
kernel-zfcpdump
kernel-default-livepatch-devel
kernel-default-debuginfo
kernel-default-devel
kernel-default-livepatch
cluster-md-kmp-default-debuginfo
gfs2-kmp-default
gfs2-kmp-default-debuginfo
dlm-kmp-default-debuginfo
cluster-md-kmp-default
dlm-kmp-default
ocfs2-kmp-default
kernel-64kb-debuginfo
kernel-64kb-devel-debuginfo
kernel-64kb-devel
kernel-64kb-debugsource
kernel-64kb
reiserfs-kmp-default
kernel-default-devel-debuginfo
kernel-default-base

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-livepatch-5_14_21-150400_24_240-default-debuginfo - update to 1-150400.9.5.1
kernel-livepatch-5_14_21-150400_24_240-default - update to 1-150400.9.5.1
kernel-livepatch-SLE15-SP4_Update_59-debugsource - update to 1-150400.9.5.1
kernel-source-rt - update to 5.14.21-150400.15.186.1
kernel-rt-debugsource - update to 5.14.21-150400.15.186.1
kernel-rt-debuginfo - update to 5.14.21-150400.15.186.1
kernel-rt - update to 5.14.21-150400.15.186.1
kernel-obs-build - update to 5.14.21-150400.24.240.1
kernel-docs - update to 5.14.21-150400.24.240.1
kernel-devel - update to 5.14.21-150400.24.240.1
kernel-macros - update to 5.14.21-150400.24.240.1
kernel-syms - update to 5.14.21-150400.24.240.1
kernel-obs-build-debugsource - update to 5.14.21-150400.24.240.1
kernel-source - update to 5.14.21-150400.24.240.1
ocfs2-kmp-default-debuginfo - update to 5.14.21-150400.24.240.2
kernel-default - update to 5.14.21-150400.24.240.2
reiserfs-kmp-default-debuginfo - update to 5.14.21-150400.24.240.2
kernel-default-debugsource - update to 5.14.21-150400.24.240.2
kernel-zfcpdump-debugsource - update to 5.14.21-150400.24.240.2
kernel-zfcpdump-debuginfo - update to 5.14.21-150400.24.240.2
kernel-zfcpdump - update to 5.14.21-150400.24.240.2
kernel-default-livepatch-devel - update to 5.14.21-150400.24.240.2
kernel-default-debuginfo - update to 5.14.21-150400.24.240.2
kernel-default-devel - update to 5.14.21-150400.24.240.2
kernel-default-livepatch - update to 5.14.21-150400.24.240.2
cluster-md-kmp-default-debuginfo - update to 5.14.21-150400.24.240.2
gfs2-kmp-default - update to 5.14.21-150400.24.240.2
gfs2-kmp-default-debuginfo - update to 5.14.21-150400.24.240.2
dlm-kmp-default-debuginfo - update to 5.14.21-150400.24.240.2
cluster-md-kmp-default - update to 5.14.21-150400.24.240.2
dlm-kmp-default - update to 5.14.21-150400.24.240.2
ocfs2-kmp-default - update to 5.14.21-150400.24.240.2
kernel-64kb-debuginfo - update to 5.14.21-150400.24.240.2
kernel-64kb-devel-debuginfo - update to 5.14.21-150400.24.240.2
kernel-64kb-devel - update to 5.14.21-150400.24.240.2
kernel-64kb-debugsource - update to 5.14.21-150400.24.240.2
kernel-64kb - update to 5.14.21-150400.24.240.2
reiserfs-kmp-default - update to 5.14.21-150400.24.240.2
kernel-default-devel-debuginfo - update to 5.14.21-150400.24.240.2
kernel-default-base - update to 5.14.21-150400.24.240.2.150400.24.120.2

• https://git.kernel.org/stable/c/1c1b7e8e545ce65e40f65b55c432765e058ea98f
• https://git.kernel.org/stable/c/2940cc3cf43c72126b74ee6376314c195382023a
• https://git.kernel.org/stable/c/3035bb784cea3f338934f5042dd3f35225a51b2e
• https://git.kernel.org/stable/c/c172e4c53321ee6429955295ea133bc3597a3ca9
• https://git.kernel.org/stable/c/db09bc4ab19ce548a078240d2374792523953500
• https://git.kernel.org/stable/c/e8315330e4ec09c0cac625515400e13d0ee22b81
• https://git.kernel.org/stable/c/e8b784a3f4fba3ea9c4d05138ecfa784a069627f
• https://git.kernel.org/stable/c/f495b6c4c8594122918552c9be2b51eb71647cd9

• Use-after-free in Linux kernel core
• SUSE update for the Linux Kernel
• SUSE update for the Linux Kernel