All vulnerabilities
CVE-2026-98266

Linux: ALSA: core: Fix potential UAF after asynchronous card release

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5c0df40aa577e405c458e44e8d458dd78407f4afAlso 2dec4642589a663e064e4411d92d6e8fa250d53b, 398b21608955c9712a012355b69a39407367edc9CVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 5c0df40aa577e405c458e44e8d458dd78407f4afLinuxCVE List
  • 2dec4642589a663e064e4411d92d6e8fa250d53bLinuxCVE List
  • 398b21608955c9712a012355b69a39407367edc9LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: core: Fix potential UAF after asynchronous card release

Usually a sound driver releases the resources assigned to the card via snd_card_free(), and it synchronizes with the whole release procedure. However, when the card is released asynchronously via snd_card_free_when_closed() like USB-audio driver, the situation is slightly different; although the snd_card_disconnect() call at the disconnection guarantees that any newer accesses will be gated, the in-flight tasks might be still accessing to the underlying card->dev device even after the disconnection, which would cause a use-after-free in the end, as reported by fuzzers.

For addressing the bug above, this patch takes the refcount of card->dev at initialization of the card object, and releases at its destructor. This assures the availability of the card->dev in its whole lifecycle.

Text from CVE List

Affected versions 10

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 5c0df40aa577e405c458e44e8d458dd78407f4afCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2dec4642589a663e064e4411d92d6e8fa250d53bCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 398b21608955c9712a012355b69a39407367edc9CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before fd95e68df6fe66344161a1329cbe5e5805e7b704CVE List
  • Linuxaffected: 2.6.12CVE List
  • Linuxunaffected: all versions before 2.6.12CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4