In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Serialize readq reset state with q->lock snd_seq_oss_readq_clear() resets qlen, head, and tail without q->lock even though the normal reader and producer paths serialize the same ring state under that spinlock. A reset can therefore race snd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and leave stale records in the queue, drop freshly queued ones, or report the wrong readiness after wakeup. KCSAN reports a data race between snd_seq_oss_readq_clear() and snd_seq_oss_readq_free(). Take q->lock while clearing the ring and resetting input_time. Factor the enqueue logic into a caller-locked helper so snd_seq_oss_readq_put_timestamp() updates its suppression state under the same lock instead of racing the reset path. The buggy scenario involves two paths, with each column showing the order within that path: reset path: locked readq updater: 1. snd_seq_oss_reset() or
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80628 is a race condition vulnerability in the Linux kernel's ALSA (Advanced Linux Sound Architecture) sequencer OSS compatibility layer. Specifically, the snd_seq_oss_readq_clear() function resets queue state variables (qlen, head, and tail) without proper synchronization using the q->lock spinlock, while other code paths that access these same variables do hold the lock. This creates a classic Time-of-Check-Time-of-Use (TOCTOU) race condition that can result in stale queue records, dropped events, or incorrect readiness notifications. Any system running a vulnerable Linux kernel with ALSA sequencer support could be affected, particularly those handling audio sequencing operations or using OSS-compatible sound applications. The high CVSS score of 7.8 reflects the potential for denial of service or data corruption through race-condition exploitation.
While this CVE currently maps to zero Casky skills in the MITRE ATT&CK framework, practitioners using Casky.ai's Claude-powered analysis would detect the underlying attack surface by examining synchronization vulnerabilities and concurrency flaws. The platform's 754 mapped security skills would flag patterns associated with kernel-level race conditions, improper locking mechanisms, and inter-process communication exploits—techniques that fall under Resource Hijacking (T1563) and Exploitation for Privilege Escalation. Security teams would see findings highlighting unsynchronized access to shared kernel data structures, missing spinlock protection in state-reset operations, and potential causality violations in event queuing. Practitioners should prioritize kernel updates and monitor for exploitation attempts targeting audio subsystem access as part of their threat detection strategy.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80628. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation