{"api_version":"1","generated_at":"2026-09-20T17:02:57+00:00","cve":"CVE-2026-89980","urls":{"html":"https://cve.report/CVE-2026-89980","api":"https://cve.report/api/cve/CVE-2026-89980.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89980","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89980"},"summary":{"title":"ALSA: harmony: initialize locks before requesting IRQ","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: harmony: initialize locks before requesting IRQ\n\nsnd_harmony_create() registers the IRQ before initializing h->lock and\nh->mixer_lock. A pending interrupt can invoke the handler while these\nlocks are uninitialized.\n\nInitialize both locks before requesting the IRQ so the handler always\nsees valid lock state.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-16 11:17:08","updated_at":"2026-09-16 15:18:22"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"8.4","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.4","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/f86ff9238b0c8284909e073a681a60708b9f36ab","name":"https://git.kernel.org/stable/c/f86ff9238b0c8284909e073a681a60708b9f36ab","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7dc239edb6d58e01c9ec868565cc03e7adf91747","name":"https://git.kernel.org/stable/c/7dc239edb6d58e01c9ec868565cc03e7adf91747","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/cd209eb3136e002becbda232e399fa31a2276436","name":"https://git.kernel.org/stable/c/cd209eb3136e002becbda232e399fa31a2276436","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/89992bda7dfbba7ded2ba4185730453c57fa65bc","name":"https://git.kernel.org/stable/c/89992bda7dfbba7ded2ba4185730453c57fa65bc","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9af6c9203583655cb7ed45e52e14101652b37547","name":"https://git.kernel.org/stable/c/9af6c9203583655cb7ed45e52e14101652b37547","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/33abb7491e89285a41565670945293dda841afc4","name":"https://git.kernel.org/stable/c/33abb7491e89285a41565670945293dda841afc4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9347588bbd6ad43a85e17046d9c117a41453c52a","name":"https://git.kernel.org/stable/c/9347588bbd6ad43a85e17046d9c117a41453c52a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89980","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89980","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 9af6c9203583655cb7ed45e52e14101652b37547 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 f86ff9238b0c8284909e073a681a60708b9f36ab git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 7dc239edb6d58e01c9ec868565cc03e7adf91747 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 9347588bbd6ad43a85e17046d9c117a41453c52a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 89992bda7dfbba7ded2ba4185730453c57fa65bc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 cd209eb3136e002becbda232e399fa31a2276436 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 33abb7491e89285a41565670945293dda841afc4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.12","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.12 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.221 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.188 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.157 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.110 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.51 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.5 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/parisc/harmony.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9af6c9203583655cb7ed45e52e14101652b37547","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"f86ff9238b0c8284909e073a681a60708b9f36ab","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"7dc239edb6d58e01c9ec868565cc03e7adf91747","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"9347588bbd6ad43a85e17046d9c117a41453c52a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"89992bda7dfbba7ded2ba4185730453c57fa65bc","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"cd209eb3136e002becbda232e399fa31a2276436","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"33abb7491e89285a41565670945293dda841afc4","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/parisc/harmony.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.221","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.188","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.157","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.110","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.51","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.221","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.188","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.157","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.110","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.51","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.5","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc2","versionStartIncluding":"2.6.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: harmony: initialize locks before requesting IRQ\n\nsnd_harmony_create() registers the IRQ before initializing h->lock and\nh->mixer_lock. A pending interrupt can invoke the handler while these\nlocks are uninitialized.\n\nInitialize both locks before requesting the IRQ so the handler always\nsees valid lock state."}],"metrics":[{"cvssV3_1":{"baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only from snd_harmony_probe() → snd_harmony_create() → request_irq() → snd_harmony_interrupt() on onboard HP PA-RISC LASI/ASP Harmony audio, which enumerates at boot or module bind. There is no network, Bluetooth, or USB packet path into this GSC chip.\nAC:L - snd_harmony_create() calls request_irq() before spin_lock_init() and before pcm_init()'s harmony_disable_interrupts(). Firmware leftover DSTATUS_IE plus pending PN/RN lets gsc_asic_unmask_irq() deliver snd_harmony_interrupt() immediately against uninitialized h->lock, without an attacker-uncontrollable race.\nPR:N - snd_harmony_create() performs no capability or authentication checks before request_irq(). On GSC/LASI PA-RISC workstations and servers with Harmony, kernel/udev enumeration runs the vulnerable probe automatically without an OS account or user-namespace privilege.\nUI:N - No victim action is required. A pending Harmony interrupt during driver probe at boot or module autoload invokes the uninitialized-lock IRQ path without anyone opening ALSA PCM or control nodes.\nS:U - Impact is uninitialized spinlock use and DMA next-address programming inside the host kernel Harmony driver. This does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - snd_harmony_interrupt() takes uninitialized h->lock in hard-IRQ context and, with psubs/csubs still NULL, programs HARMONY_PNXTADD from zeroed sdma so the chip DMAs from physical address 0. That undefined lock/DMA behavior can disclose kernel memory rather than a small bounded leak.\nI:H - On SMP PA-RISC (defconfig), probe can spin_lock_init() h->lock while the IRQ handler still holds the zeroed lock, and the handler writes HARMONY_RNXTADD/PNXTADD (including 0) in that window. That lock-state corruption and invalid DMA programming are write/control-flow primitives, not a pure crash.\nA:H - Taking uninitialized h->lock in snd_harmony_interrupt() during probe hits DEBUG_SPINLOCK bad-magic BUG, lockdep non-static-key failure, oops/panic, or a hung IRQ/DMA path on affected PA-RISC machines, fully denying availability."}]}],"providerMetadata":{"dateUpdated":"2026-09-16T14:40:59.448Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/9af6c9203583655cb7ed45e52e14101652b37547"},{"url":"https://git.kernel.org/stable/c/f86ff9238b0c8284909e073a681a60708b9f36ab"},{"url":"https://git.kernel.org/stable/c/7dc239edb6d58e01c9ec868565cc03e7adf91747"},{"url":"https://git.kernel.org/stable/c/9347588bbd6ad43a85e17046d9c117a41453c52a"},{"url":"https://git.kernel.org/stable/c/89992bda7dfbba7ded2ba4185730453c57fa65bc"},{"url":"https://git.kernel.org/stable/c/cd209eb3136e002becbda232e399fa31a2276436"},{"url":"https://git.kernel.org/stable/c/33abb7491e89285a41565670945293dda841afc4"}],"title":"ALSA: harmony: initialize locks before requesting IRQ","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89980","datePublished":"2026-09-16T10:32:57.355Z","dateReserved":"2026-09-11T19:38:34.779Z","dateUpdated":"2026-09-16T14:40:59.448Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-16 11:17:08","lastModifiedDate":"2026-09-16 15:18:22","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89980","Ordinal":"1","Title":"ALSA: harmony: initialize locks before requesting IRQ","CVE":"CVE-2026-89980","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89980","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: harmony: initialize locks before requesting IRQ\n\nsnd_harmony_create() registers the IRQ before initializing h->lock and\nh->mixer_lock. A pending interrupt can invoke the handler while these\nlocks are uninitialized.\n\nInitialize both locks before requesting the IRQ so the handler always\nsees valid lock state.","Type":"Description","Title":"ALSA: harmony: initialize locks before requesting IRQ"}]}}}