Cloudanix VulnDB

CVE-2026-98266

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux sound handling could let attackers crash the system or run harmful code when certain audio devices are removed at the wrong moment.

Chainable
Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Potential use-after-free in ALSA core when asynchronous card release via snd_card_free_when_closed allows in-flight tasks to access card->dev after snd_card_disconnect has gated new operations.

Why it matters to the business

Kernel instability, crashes, or possible privilege escalation on Linux systems using affected audio drivers, particularly USB-audio, increasing downtime and security exposure for audio-dependent workloads.

How an attack unfolds

An attacker triggers asynchronous card release on a device such as USB-audio while concurrent kernel tasks still hold references to the card device structure; the missing refcount allows access to memory that has already been freed.

How to fix it

Update the Linux kernel to a version containing the reference-counting fix that holds card->dev from card initialization through destructor.

How to confirm the fix worked

Confirm the patch by inspecting snd_card initialization and destructor for explicit get/put of card->dev; test asynchronous release paths with USB-audio devices.

Typical attack path

  1. Initiate device disconnection to invoke snd_card_free_when_closed
  2. Ensure in-flight operations continue to reference card->dev after disconnect
  3. Access the freed memory region to trigger use-after-free

How to detect it

Inspect kernel logs and crash dumps for use-after-free reports involving ALSA card release; correlate audio device disconnect events with concurrent sound operations.

What your security team should do

  • Apply the kernel fix promptly on systems exposing ALSA audio devices
  • Monitor kernel logs for ALSA-related use-after-free crashes
  • Limit exposure by avoiding unnecessary asynchronous release paths where possible

The record

In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix potential UAF after asynchronous card release Usually a sound driver releases the resources assigned to the card via snd_card_free(), and it synchronizes with the whole release procedure. However, when the card is released asynchronously via snd_card_free_when_closed() like USB-audio driver, the situation is slightly different; although the snd_card_disconnect() call at the disconnection guarantees that any newer accesses will be gated, the in-flight tasks might be still accessing to the underlying card->dev device even after the disconnection, which would cause a use-after-free in the end, as reported by fuzzers. For addressing the bug above, this patch takes the refcount of card->dev at initialization of the card object, and releases at its destructor. This assures the availability of the card->dev in its whole lifecycle.

Affected packages

Ecosystem Package Introduced Fixed