CVE-2026-98266

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix potential UAF after asynchronous card release Usually a sound driver releases the resources assigned to the card via snd_card_free(), and it synchronizes with the whole release procedure. However, when the card is released asynchronously via snd_card_free_when_closed() like USB-audio driver, the situation is slightly different; although the snd_card_disconnect() call at the disconnection guarantees that any newer accesses will be gated, the in-flight tasks might be still accessing to the underlying card->dev device even after the disconnection, which would cause a use-after-free in the end, as reported by fuzzers. For addressing the bug above, this patch takes the refcount of card->dev at initialization of the card object, and releases at its destructor. This assures the availability of the card->dev in its whole lifecycle.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98266

EUVD

EUVD-2026-93194

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	2.6.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free (UAF) issue in the ALSA sound driver subsystem. When a sound card is released asynchronously, in-flight tasks might still access the card's device structure after disconnection, leading to a UAF condition. The fix ensures the card's device remains available throughout its lifecycle by managing its reference count properly.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA sound driver and requires kernel-level detection. Check if your system uses a vulnerable kernel version with uname -a. Monitor kernel logs for use-after-free errors related to sound card devices. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a system crash by exploiting the UAF condition. Systems using affected Linux kernel versions with USB-audio drivers might be vulnerable to denial-of-service or privilege escalation attacks.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's ALSA sound driver, which could lead to memory corruption or crashes. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory safety.

Mitigation Strategies

Update your Linux kernel to the latest patched version. If using a distribution kernel, apply vendor-provided updates immediately. For custom kernels, apply the patch that fixes snd_card_free_when_closed() use-after-free. Reboot the system after applying updates.

Hi! I’m here to help you understand CVE-2026-98266. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70