Executive brief
A vulnerability was identified in the Linux kernel's audio loopback driver (ALSA aloop) that could lead to a system crash or unpredictable behavior. The issue occurs when the system attempts to stop an audio capture stream while it is simultaneously being closed, potentially leading to a 'use-after-free' condition where the system tries to access memory that has already been released. This could be exploited by a local user to cause a denial-of-service (system crash).
Technical details
A use-after-free (UAF) vulnerability exists in sound/drivers/aloop.c within the Linux kernel's ALSA loopback implementation. The root cause is a race condition in loopback_check_format() where a peer lookup is performed under cable->lock, but the subsequent snd_pcm_stop() call occurs after the lock is released. If a concurrent close operation clears the capture entry and frees its runtime during this window, the playback trigger path may attempt to use a stale peer substream pointer. The fix introduces a per-cable atomic stop_count and a wait queue to ensure that free_cable() waits for all in-flight peer stops to complete before detaching the runtime.
Affected products
- Linux Linux Kernel All versions prior to the fix in May 2026
Timeline
- 2026-05-27: disclosed: CVE-2026-46090 published
- 2026-05-14: patched: Fix committed to Linux stable tree