CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix use-after-free in sndusbmixerfree()
When sndusbcreatemixer() fails, sndusbmixerfree() frees mixer->idelems but the controls already added to the card still reference the freed memory. Later when sndcardregister() runs, the OSS mixer layer calls their callbacks and hits a use-after-free read.
Call trace: getctlvalue+0x63f/0x820 sound/usb/mixer.c:411 getminmaxwithquirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241 mixerctlfeatureinfo+0x26b/0x490 sound/usb/mixer.c:1381 sndmixerossbuildtest+0x174/0x3a0 sound/core/oss/mixeross.c:887 ... sndcardregister+0x4ed/0x6d0 sound/core/init.c:923 usbaudioprobe+0x5ef/0x2a90 sound/usb/card.c:1025
Fix by calling sndctlremove() for all mixer controls before freeing idelems. We save the next pointer first because sndctlremove() frees the current element.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23089?
The severity of CVE-2026-23089 is classified as medium due to the potential for a use-after-free vulnerability in the ALSA USB audio subsystem.
How do I fix CVE-2026-23089?
To fix CVE-2026-23089, update to a patched version of the Linux kernel where the vulnerability has been resolved.
What systems are impacted by CVE-2026-23089?
CVE-2026-23089 affects any systems running the vulnerable versions of the ALSA USB audio driver in the Linux kernel.
What is the impact of CVE-2026-23089?
The impact of CVE-2026-23089 could lead to a system crash or potentially allow remote code execution due to the use-after-free condition.
Has CVE-2026-23089 been publicly disclosed?
Yes, CVE-2026-23089 has been publicly disclosed and the fix is available in the latest kernel updates.