CVE-2026-89736: usb: gadget: u_audio: Fix use-after-free on sound card disconnect

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: uaudio: Fix use-after-free on sound card disconnect

gaudiocleanup() invokes sndcardfreewhenclosed() to initiate sound card teardown and immediately frees the underlying struct snduacchip context. However, sndcardfreewhenclosed() returns asynchronously while ALSA control elements (kctls) remain open in userspace.

When userspace control applications access or close these open file descriptors, kctl callbacks attempt to dereference kctl->privatedata pointing to &uac->cprm or &uac->pprm within the freed uac structure, resulting in a use-after-free (UAF) memory corruption.

Fix this issue by deferring the destruction of struct snduacchip until all references to the ALSA sound card are released. Register a custom card->privatefree callback (uaudiocardfree) during gaudiosetup() that frees uac and its associated playback/capture request and ring buffers only when the sound card reference count drops to zero.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Update/patch the kernel USB gadget u_audio driver to defer destroying struct snd_uac_chip until all userspace references to the ALSA sound card are released, so that snd_card_free_when_closed() only frees the underlying u_audio structures after the sound card reference count reaches zero. Ensure the card->private_free callback (u_audio_card_free) is registered during g_audio_setup() and that g_audio_cleanup() relies on snd_card_free_when_closed() to initiate teardown.

    Linux kernel (USB gadget: u_audio / ALSA) Defer destruction of struct snd_uac_chip until snd_card_free_when_closed() completion (sound card reference count drops to zero) = Implement deferred free via card->private_free (u_audio_card_free) and avoid freeing uac/chip while ALSA control (kctls) remain open

Event History

Sep 11, 2026
CVE Published
via MITRE·07:46 PM
Data Sourced
via MITRE·07:46 PM
Description

Frequently Asked Questions

1

Which systems are exposed to this issue?

Systems using the Linux USB gadget u_audio component are exposed when the associated ALSA sound card is disconnected while userspace still has ALSA control elements open. Systems that do not use this USB audio gadget path are not described as affected.

2

What must happen for the use-after-free to be triggered?

A userspace application must retain open ALSA control file descriptors across sound-card teardown. Subsequent access to, or closing of, those descriptors can invoke control callbacks that dereference data from the already-freed u_audio context.

3

What is the practical remediation behavior?

The resolved implementation defers freeing the snd_uac_chip context and its playback/capture request and ring buffers until all references to the ALSA sound card have been released. This prevents open ALSA control elements from retaining pointers into freed memory.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203