CVE-2026-98266ALSA: core: Fix potential UAF after asynchronous card release
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix potential UAF after asynchronous card release Usually a sound driver releases the resources assigned to the card via snd_card_free(), and it synchronizes with the whole release procedure. However, when the card is released asynchronously via snd_card_free_when_closed() like USB-audio driver, the situation is slightly different; although the snd_card_disconnect() call at the disconnection guarantees that any newer accesses will be gated, the in-flight tasks might be still accessing to the underlying card->dev device even after the disconnection, which would cause a use-after-free in the end, as reported by fuzzers. For addressing the bug above, this patch takes the refcount of card->dev at initialization of the card object, and releases at its destructor. This assures the availability of the card->dev in its whole lifecycle.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 7, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 5c0df40aa577e405c458e44e8d458dd78407f4af; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2dec4642589a663e064e4411d92d6e8fa250d53b; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 398b21608955c9712a012355b69a39407367edc9; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before fd95e68df6fe66344161a1329cbe5e5805e7b704 | CNA record |
References
- https://git.kernel.org/stable/c/5c0df40aa577e405c458e44e8d458dd78407f4af
- https://git.kernel.org/stable/c/2dec4642589a663e064e4411d92d6e8fa250d53b
- https://git.kernel.org/stable/c/398b21608955c9712a012355b69a39407367edc9
- https://git.kernel.org/stable/c/fd95e68df6fe66344161a1329cbe5e5805e7b704
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.