CVE-2026-98266

Summary

In the Linux kernel, the following vulnerability has been resolved:

ALSA: core: Fix potential UAF after asynchronous card release

Usually a sound driver releases the resources assigned to the card via snd_card_free(), and it synchronizes with the whole release procedure. However, when the card is released asynchronously via snd_card_free_when_closed() like USB-audio driver, the situation is slightly different; although the snd_card_disconnect() call at the disconnection guarantees that any newer accesses will be gated, the in-flight tasks might be still accessing to the underlying card->dev device even after the disconnection, which would cause a use-after-free in the end, as reported by fuzzers.

For addressing the bug above, this patch takes the refcount of card->dev at initialization of the card object, and releases at its destructor. This assures the availability of the card->dev in its whole lifecycle.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5c0df40aa577e405c458e44e8d458dd78407f4afaffected
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2dec4642589a663e064e4411d92d6e8fa250d53baffected
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 398b21608955c9712a012355b69a39407367edc9affected
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < fd95e68df6fe66344161a1329cbe5e5805e7b704affected
LinuxLinux0 < 6.12.112affected
LinuxLinux0 < 6.18.54affected
LinuxLinux0 < 7.2.8affected
LinuxLinux6.12.112 <= 6.12.*unaffected
LinuxLinux6.18.54 <= 6.18.*unaffected
LinuxLinux7.2.8 <= 7.2.*unaffected
LinuxLinux7.3-rc4 <= *unaffected

Weaknesses

References