CVE-2026-89736
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix use-after-free on sound card disconnect g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound card teardown and immediately frees the underlying struct snd_uac_chip context. However, snd_card_free_when_closed() returns asynchronously while ALSA control elements (kctls) remain open in userspace. When userspace control applications access or close these open file descriptors, kctl callbacks attempt to dereference kctl->private_data pointing to &uac->c_prm or &uac->p_prm within the freed uac structure, resulting in a use-after-free (UAF) memory corruption. Fix this issue by deferring the destruction of struct snd_uac_chip until all references to the ALSA sound card are released. Register a custom card->private_free callback (u_audio_card_free) during g_audio_setup() that frees uac and its associated playback/capture request and ring buffers only when the sound card reference count drops to zero.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 33f341c1fc60e172a3515c51bdabee11e83d1ee9 | affected | git | a7ecd1a04f4f485d7be6443d0f0b2c61a800cb82 | Unavailable | None listed |
| b131989797f7287d7fdadb2bababc05a15d44750 | affected | git | f983793f03148b097977f200298db215cd2d4438 | Unavailable | None listed |
| 3bc7324e4911351e39c54a62e6ca46321cb10faf | affected | git | 6f46762196f04464e1050a9ee94e72b917db9010 | Unavailable | None listed |
| 6c67ed9ad9b83e453e808f9b31a931a20a25629b | affected | git | 891a8d11f4d5eb50b2ce7570f4f98204a7a57493 | Unavailable | None listed |
| 6c67ed9ad9b83e453e808f9b31a931a20a25629b | affected | git | c74ff0b1a0fca53d3ac185873c87d6a719b30a47 | Unavailable | None listed |
| 6c67ed9ad9b83e453e808f9b31a931a20a25629b | affected | git | 4e747c864a88537e18b1ffc19a1954c9686bb8e1 | Unavailable | None listed |
| 6c67ed9ad9b83e453e808f9b31a931a20a25629b | affected | git | 79a92896e2bb9471550c56fc23d8d93592f04c27 | Unavailable | None listed |
| 6c67ed9ad9b83e453e808f9b31a931a20a25629b | affected | git | 858965947081d10d41d9a1010a540d3d5eea958b | Unavailable | None listed |
| 3e016ef2e72da93a2ea7afbb45de1b481b44d761 | affected | git | Unavailable | Unavailable | None listed |
| 3256e152b645fc1e788ba44c2d8ced690113e3e6 | affected | git | Unavailable | Unavailable | None listed |
| 0eda2004f38d95ef5715d62be884cd344260535b | affected | git | Unavailable | Unavailable | None listed |
| 43ca70753dfffd517d2af126da28690f8f615605 | affected | git | Unavailable | Unavailable | None listed |
| 5.10.177 | affected | semver | 5.10.270 | Unavailable | None listed |
| 5.15.105 | affected | semver | 5.15.221 | Unavailable | None listed |
| 6.1.22 | affected | semver | 6.1.188 | Unavailable | None listed |
| 4.14.312 | affected | semver | 4.15 | Unavailable | None listed |
| 4.19.280 | affected | semver | 4.20 | Unavailable | None listed |
| 5.4.240 | affected | semver | 5.5 | Unavailable | None listed |
| 6.2.9 | affected | semver | 6.3 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.3 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 6.3 | Unavailable | None listed |
| 5.10.270 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.221 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.188 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.157 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.109 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.50 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.2.4 | unaffected | semver | Unavailable | 7.2.* | None listed |
| 7.3 | unaffected | original_commit_for_fix | Unavailable | * | None listed |