CVE-2026-89736
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix use-after-free on sound card disconnect g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound card teardown and immediately frees the underlying struct snd_uac_chip context. However, snd_card_free_when_closed() returns asynchronously while ALSA control elements (kctls) remain open in userspace. When userspace control applications access or close these open file descriptors, kctl callbacks attempt to dereference kctl->private_data pointing to &uac->c_prm or &uac->p_prm within the freed uac structure, resulting in a use-after-free (UAF) memory corruption. Fix this issue by deferring the destruction of struct snd_uac_chip until all references to the ALSA sound card are released. Register a custom card->private_free callback (u_audio_card_free) during g_audio_setup() that frees uac and its associated playback/capture request and ring buffers only when the sound card reference count drops to zero.
INFO
Published Date :
Sept. 11, 2026, 8:20 p.m.
Last Modified :
Sept. 14, 2026, 1:19 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Register a custom card private_free callback.
- Free uac and buffers when sound card reference count is zero.
- Apply the Linux kernel patch for usb: gadget: u_audio.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-89736.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-89736 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-89736
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-89736 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-89736 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 14, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/89xxx/CVE-2026-89736.json">CVE-2026-89736</a> Added Reference https://git.kernel.org/stable/c/6f46762196f04464e1050a9ee94e72b917db9010 Added Reference https://git.kernel.org/stable/c/891a8d11f4d5eb50b2ce7570f4f98204a7a57493 Added Reference https://git.kernel.org/stable/c/a7ecd1a04f4f485d7be6443d0f0b2c61a800cb82 Added Reference https://git.kernel.org/stable/c/f983793f03148b097977f200298db215cd2d4438 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 13, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 11, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix use-after-free on sound card disconnect g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound card teardown and immediately frees the underlying struct snd_uac_chip context. However, snd_card_free_when_closed() returns asynchronously while ALSA control elements (kctls) remain open in userspace. When userspace control applications access or close these open file descriptors, kctl callbacks attempt to dereference kctl->private_data pointing to &uac->c_prm or &uac->p_prm within the freed uac structure, resulting in a use-after-free (UAF) memory corruption. Fix this issue by deferring the destruction of struct snd_uac_chip until all references to the ALSA sound card are released. Register a custom card->private_free callback (u_audio_card_free) during g_audio_setup() that frees uac and its associated playback/capture request and ring buffers only when the sound card reference count drops to zero. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/89xxx/CVE-2026-89736.json">CVE-2026-89736</a> Added Reference https://git.kernel.org/stable/c/4e747c864a88537e18b1ffc19a1954c9686bb8e1 Added Reference https://git.kernel.org/stable/c/79a92896e2bb9471550c56fc23d8d93592f04c27 Added Reference https://git.kernel.org/stable/c/858965947081d10d41d9a1010a540d3d5eea958b Added Reference https://git.kernel.org/stable/c/c74ff0b1a0fca53d3ac185873c87d6a719b30a47