{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89980","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-11T19:38:34.779Z","datePublished":"2026-09-16T10:32:57.355Z","dateUpdated":"2026-09-16T14:40:59.448Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-16T14:40:59.448Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: harmony: initialize locks before requesting IRQ\n\nsnd_harmony_create() registers the IRQ before initializing h->lock and\nh->mixer_lock. A pending interrupt can invoke the handler while these\nlocks are uninitialized.\n\nInitialize both locks before requesting the IRQ so the handler always\nsees valid lock state."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only from snd_harmony_probe() → snd_harmony_create() → request_irq() → snd_harmony_interrupt() on onboard HP PA-RISC LASI/ASP Harmony audio, which enumerates at boot or module bind. There is no network, Bluetooth, or USB packet path into this GSC chip.\nAC:L - snd_harmony_create() calls request_irq() before spin_lock_init() and before pcm_init()'s harmony_disable_interrupts(). Firmware leftover DSTATUS_IE plus pending PN/RN lets gsc_asic_unmask_irq() deliver snd_harmony_interrupt() immediately against uninitialized h->lock, without an attacker-uncontrollable race.\nPR:N - snd_harmony_create() performs no capability or authentication checks before request_irq(). On GSC/LASI PA-RISC workstations and servers with Harmony, kernel/udev enumeration runs the vulnerable probe automatically without an OS account or user-namespace privilege.\nUI:N - No victim action is required. A pending Harmony interrupt during driver probe at boot or module autoload invokes the uninitialized-lock IRQ path without anyone opening ALSA PCM or control nodes.\nS:U - Impact is uninitialized spinlock use and DMA next-address programming inside the host kernel Harmony driver. This does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - snd_harmony_interrupt() takes uninitialized h->lock in hard-IRQ context and, with psubs/csubs still NULL, programs HARMONY_PNXTADD from zeroed sdma so the chip DMAs from physical address 0. That undefined lock/DMA behavior can disclose kernel memory rather than a small bounded leak.\nI:H - On SMP PA-RISC (defconfig), probe can spin_lock_init() h->lock while the IRQ handler still holds the zeroed lock, and the handler writes HARMONY_RNXTADD/PNXTADD (including 0) in that window. That lock-state corruption and invalid DMA programming are write/control-flow primitives, not a pure crash.\nA:H - Taking uninitialized h->lock in snd_harmony_interrupt() during probe hits DEBUG_SPINLOCK bad-magic BUG, lockdep non-static-key failure, oops/panic, or a hung IRQ/DMA path on affected PA-RISC machines, fully denying availability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/parisc/harmony.c"],"versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9af6c9203583655cb7ed45e52e14101652b37547","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f86ff9238b0c8284909e073a681a60708b9f36ab","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7dc239edb6d58e01c9ec868565cc03e7adf91747","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9347588bbd6ad43a85e17046d9c117a41453c52a","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"89992bda7dfbba7ded2ba4185730453c57fa65bc","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"cd209eb3136e002becbda232e399fa31a2276436","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"33abb7491e89285a41565670945293dda841afc4","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/parisc/harmony.c"],"versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","status":"unaffected","versionType":"semver"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.15.221"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.1.188"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.12.110"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.18.51"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.2.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.3-rc2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/9af6c9203583655cb7ed45e52e14101652b37547"},{"url":"https://git.kernel.org/stable/c/f86ff9238b0c8284909e073a681a60708b9f36ab"},{"url":"https://git.kernel.org/stable/c/7dc239edb6d58e01c9ec868565cc03e7adf91747"},{"url":"https://git.kernel.org/stable/c/9347588bbd6ad43a85e17046d9c117a41453c52a"},{"url":"https://git.kernel.org/stable/c/89992bda7dfbba7ded2ba4185730453c57fa65bc"},{"url":"https://git.kernel.org/stable/c/cd209eb3136e002becbda232e399fa31a2276436"},{"url":"https://git.kernel.org/stable/c/33abb7491e89285a41565670945293dda841afc4"}],"title":"ALSA: harmony: initialize locks before requesting IRQ","x_generator":{"engine":"bippy-1.2.0"}}}}