CVE-2026-89736 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound card teardown and immediately frees the underlying struct snd_uac_chip context. However, snd_card_free_when_closed() returns asynchronously while ALSA control elements (kctls) remain open in userspace.
When userspace control applications access or close these open file descriptors, kctl callbacks attempt to dereference kctl->private_data pointing to &uac->c_prm or &uac->p_prm within the freed uac structure, resulting in a use-after-free (UAF) memory corruption.
Fix this issue by deferring the destruction of struct snd_uac_chip until all references to the ALSA sound card are released. Register a custom card->private_free callback (u_audio_card_free) during g_audio_setup() that frees uac and its associated playback/capture request and ring buffers only when the sound card reference count drops to zero.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The Linux kernel vulnerability identified in the usb gadget audio driver, specifically within the u_audio subsystem, represents a critical use-after-free condition triggered during the teardown of an ALSA sound card interface. This flaw arises from a race condition inherent in the lifecycle management of the snd_uac_chip structure relative to the asynchronous nature of resource release mechanisms provided by the Advanced Linux Sound Architecture (ALSA). When a USB gadget audio device is disconnected or when userspace applications close their handles, the cleanup routine g_audio_cleanup initiates the sound card teardown process. The core issue lies in the invocation of snd_card_free_when_closed(), which signals that the kernel should free the sound card resources only after all open file descriptors referencing it are closed by user-space processes. However, the original implementation immediately proceeds to free the underlying struct snd_uac_chip context following this call, rather than waiting for the actual release event.
This premature deallocation creates a dangerous window where userspace control applications may still hold open file descriptors associated with ALSA control elements, commonly referred to as kctls. These control elements allow user-space programs to interact with hardware parameters such as volume levels or sample rates. As long these file descriptors remain open, the kernel maintains callbacks that can be invoked upon access or closure of these handles. Because the underlying uac structure has already been freed from memory, any attempt by a kctl callback to dereference pointers within this structure results in accessing invalid memory addresses. Specifically, the code attempts to read from kctl->private_data, which points to members like &uac->c_prm or &uac->p_prm located inside the now-deallocated uac object. This constitutes a classic use-after-free vulnerability that can lead to kernel memory corruption, system instability, crashes, or potentially arbitrary code execution if an attacker can control the data written into the freed memory region before it is reallocated for another purpose.
From a classification perspective, this vulnerability aligns with CWE-416, which describes Use After Free errors where software continues to use memory after it has been reused, often leading to unpredictable behavior and security breaches. In terms of attack vectors, this flaw could be exploited by local users who have access to the USB gadget audio interface or through remote scenarios if the device is exposed via network-attached storage protocols that allow interaction with embedded Linux systems. The MITRE ATT&CK framework categorizes such exploitation techniques under T1203, Exploitation for Client Execution, particularly when targeting client-side components like media drivers, although it also falls broadly under privilege escalation vectors due to the kernel-level nature of the bug. The asynchronous return value of snd_card_free_when_closed() was not adequately synchronized with the manual memory management of the driver-specific structures, highlighting a gap in resource reference counting logic within the USB gadget audio subsystem.
The resolution implemented by the Linux kernel maintainers addresses this race condition by ensuring that the destruction of struct snd_uac_chip is deferred until all references to the ALSA sound card are truly released. This is achieved by registering a custom private_free callback, named u_audio_card_free, during the initial setup phase via g_audio_setup(). Unlike the previous immediate free operation, this new callback ensures that the uac structure and its associated playback and capture request buffers, as well as ring buffers, are only deallocated when the sound card reference count drops to zero. This approach guarantees that no active userspace file descriptors exist before memory is reclaimed, thereby eliminating the window of opportunity for use-after-free exploitation. By aligning the driver-specific cleanup with the ALSA subsystem's lifecycle management, the fix restores integrity to kernel memory operations and prevents potential denial-of-service conditions or privilege escalation attacks stemming from this specific USB audio gadget implementation flaw.