CVE-2026-89736: usb: gadget: u_audio: Fix use-after-free on sound card disconnect
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uaudio: Fix use-after-free on sound card disconnect
gaudiocleanup() invokes sndcardfreewhenclosed() to initiate sound card teardown and immediately frees the underlying struct snduacchip context. However, sndcardfreewhenclosed() returns asynchronously while ALSA control elements (kctls) remain open in userspace.
When userspace control applications access or close these open file descriptors, kctl callbacks attempt to dereference kctl->privatedata pointing to &uac->cprm or &uac->pprm within the freed uac structure, resulting in a use-after-free (UAF) memory corruption.
Fix this issue by deferring the destruction of struct snduacchip until all references to the ALSA sound card are released. Register a custom card->privatefree callback (uaudiocardfree) during gaudiosetup() that frees uac and its associated playback/capture request and ring buffers only when the sound card reference count drops to zero.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update/patch the kernel USB gadget u_audio driver to defer destroying struct snd_uac_chip until all userspace references to the ALSA sound card are released, so that snd_card_free_when_closed() only frees the underlying u_audio structures after the sound card reference count reaches zero. Ensure the card->private_free callback (u_audio_card_free) is registered during g_audio_setup() and that g_audio_cleanup() relies on snd_card_free_when_closed() to initiate teardown.
Linux kernel (USB gadget: u_audio / ALSA) Defer destruction of struct snd_uac_chip until snd_card_free_when_closed() completion (sound card reference count drops to zero) = Implement deferred free via card->private_free (u_audio_card_free) and avoid freeing uac/chip while ALSA control (kctls) remain open
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux USB gadget u_audio component are exposed when the associated ALSA sound card is disconnected while userspace still has ALSA control elements open. Systems that do not use this USB audio gadget path are not described as affected.
What must happen for the use-after-free to be triggered?
A userspace application must retain open ALSA control file descriptors across sound-card teardown. Subsequent access to, or closing of, those descriptors can invoke control callbacks that dereference data from the already-freed u_audio context.
What is the practical remediation behavior?
The resolved implementation defers freeing the snd_uac_chip context and its playback/capture request and ring buffers until all references to the ALSA sound card have been released. This prevents open ALSA control elements from retaining pointers into freed memory.