A high-severity race condition vulnerability in the Linux kernel ALSA pcxhr driver could allow a local attacker to achieve full system compromise.

The pcxhr driver performs an interrupt request before initializing necessary mutex locks. Because the interrupt handler relies on these locks, a local attacker can trigger an interrupt during the driver probe phase to cause a race condition against uninitialized memory.

Successful exploitation allows a local user to gain unauthorized control over the kernel, leading to potential data theft, integrity loss, or system-wide denial of service. With a CVSS score of 8.4, this vulnerability represents a significant risk to the availability and confidentiality of the host system, particularly in multi-tenant or shared environments.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected driver initialization errors related to the pcxhr module.

Compensating Controls: Restrict access to local system resources and hardware interfaces to authorized users only, as this vulnerability requires local access to trigger.

Public Exploit Available: Unknown.

Given the severity of this kernel-level vulnerability, administrators should prioritize applying the provided kernel patches as soon as they are made available by their respective Linux distributions. Ensuring the host kernel is updated is the most effective way to eliminate the risk of local privilege escalation associated with this flaw.