CVE-2026-23089None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees mixer->id_elems but the controls already adde…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees mixer->id_elems but the controls already added to the card still reference the freed memory. Later when snd_card_register() runs, the OSS mixer layer calls their callbacks and hits a use-after-free read.
Call trace: get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411 get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241 mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381 snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887 ... snd_card_register+0x4ed/0x6d0 sound/core/init.c:923 usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025
Fix by calling snd_ctl_remove() for all mixer controls before freeing id_elems. We save the next pointer first because snd_ctl_remove() frees the current element.
Linux >= 6639b6c2367f884ca172b78d69f7da17bfab2e5e < 51b1aa6fe7dc87356ba58df06afb9677c9b841eaLinux >= 6639b6c2367f884ca172b78d69f7da17bfab2e5e < 56fb6efd5d04caf6f14994d51ec85393b9a896c6Linux >= 6639b6c2367f884ca172b78d69f7da17bfab2e5e < 7009daeefa945973a530b2f605fe445fc03747afLinux >= 6639b6c2367f884ca172b78d69f7da17bfab2e5e < 7bff0156d13f0ad9436e5178b979b063d59f572aLinux >= 6639b6c2367f884ca172b78d69f7da17bfab2e5e < e6f103a22b08daf5df2f4aa158081840e5910963Linux >= 6639b6c2367f884ca172b78d69f7da17bfab2e5e < dc1a5dd80af1ee1f29d8375b12dd7625f6294dadLinux >= 6639b6c2367f884ca172b78d69f7da17bfab2e5e < 930e69757b74c3ae083b0c3c7419bfe7f0edc7b2Linux 2.6.13Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-98770Noneusb: gadget: midi2: Fix the jack descriptor array sizes
CVE-2026-98769Noneusb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
CVE-2026-98774Nonerust_binder: cancel deferred work items in thread exit
CVE-2026-98772NoneUSB: serial: fix port tear down use-after-free
CVE-2026-98771Noneusb: storage: sierra_ms: reject short SWoC info transfers
CVE-2026-98776Nonebinderfs: fix UAF write in binder_add_device