In the Linux kernel, the following vulnerability has been resolved:

ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

snd_pcm_drain() uses init_waitqueue_entry which does not clear
entry.prev/next, and add_wait_queue with a conditional
remove_wait_queue that is skipped when to_check is no longer
in the group after concurrent UNLINK.  The orphaned wait entry
remains on the unlinked substream sleep queue.  On the next
drain iteration, add_wait_queue adds the entry to a new queue
while still linked on the old one, corrupting both lists.  A
subsequent wake_up dereferences NULL at the func pointer
(mapped from the spinlock at offset 0 of the misinterpreted
wait_queue_head_t), causing a kernel panic.

Replace init_waitqueue_entry/add_wait_queue/conditional
remove_wait_queue with init_wait_entry/prepare_to_wait/
finish_wait.  init_wait_entry clears prev/next via
INIT_LIST_HEAD on each iteration and sets
autoremove_wake_function which auto-removes the entry on
wake-up.  finish_wait safely handles both the already-removed
and still-queued cases.

https://git.kernel.org/stable/c/7c71a9522555ff137a9ca36b15d759ca04d84788

https://git.kernel.org/stable/c/88fe2e3658726cb21ff2dcf9770bf672f9b9d31b

https://git.kernel.org/stable/c/b053fcd8912f06c30f932f5b8ec41c72de474695

https://git.kernel.org/stable/c/cac5bf3500ee6422cf64e0df0b5daeecfed42917

https://git.kernel.org/stable/c/cd98837db15f323463b8df07282ac723bd5c3fed

https://git.kernel.org/stable/c/d68b621bb5a48051932f1017a6e1bc9b18f854d0

https://git.kernel.org/stable/c/d842f26a167e77a36f3ed333b9fa99d36ef99fe6

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/core/pcm_native.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9baee36e8c5443411c4629afabafaff8a46a23fd","lessThan":"cac5bf3500ee6422cf64e0df0b5daeecfed42917","versionType":"git","status":"affected"},{"version":"fc71f888994569f87d5bee20b1ac6c9c1e3a7a79","lessThan":"d842f26a167e77a36f3ed333b9fa99d36ef99fe6","versionType":"git","status":"affected"},{"version":"629cf09464cf98670996ea5c191dc9743e6f3f00","lessThan":"d68b621bb5a48051932f1017a6e1bc9b18f854d0","versionType":"git","status":"affected"},{"version":"ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432","lessThan":"b053fcd8912f06c30f932f5b8ec41c72de474695","versionType":"git","status":"affected"},{"version":"4a758e9a1f5ed722f83c4dd35f867fe811553bcb","lessThan":"cd98837db15f323463b8df07282ac723bd5c3fed","versionType":"git","status":"affected"},{"version":"9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6","lessThan":"7c71a9522555ff137a9ca36b15d759ca04d84788","versionType":"git","status":"affected"},{"version":"9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6","lessThan":"88fe2e3658726cb21ff2dcf9770bf672f9b9d31b","versionType":"git","status":"affected"},{"version":"c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694","versionType":"git","status":"affected"},{"version":"5.10.253","lessThan":"5.10.259","versionType":"semver","status":"affected"},{"version":"6.1.167","lessThan":"6.1.176","versionType":"semver","status":"affected"},{"version":"6.6.130","lessThan":"6.6.143","versionType":"semver","status":"affected"},{"version":"6.12.78","lessThan":"6.12.94","versionType":"semver","status":"affected"},{"version":"6.18.19","lessThan":"6.18.36","versionType":"semver","status":"affected"},{"version":"6.19.9","lessThan":"6.20","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/core/pcm_native.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"5.10.259","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.94","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.36","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.13","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]