Executive brief
The Linux kernel's USB audio gadget driver has a use-after-free vulnerability in sound card teardown. When a USB audio device disconnects, the driver frees memory structures while userspace applications still hold open handles to audio controls. Subsequent access to these controls by the applications causes memory corruption, potentially leading to crashes or arbitrary code execution on affected systems.
Technical details
The vulnerability exists in the u_audio gadget function (drivers/usb/gadget/function/u_audio.c). The g_audio_cleanup() function calls snd_card_free_when_closed() to initiate asynchronous sound card teardown, but immediately frees the underlying struct snd_uac_chip context without waiting for all ALSA control element references to be released. When userspace applications with open ALSA control file descriptors later access or close these handles, the kctl callbacks dereference freed memory in &uac->c_prm or &uac->p_prm, causing use-after-free memory corruption. The fix registers a custom card->private_free callback (u_audio_card_free) that defers destruction of snd_uac_chip and associated buffers until the sound card reference count drops to zero. The patch is available in stable kernel branches.
Affected products
- Linux Linux kernel affected versions across multiple kernel branches (2.6.x through 7.x)
Timeline
- 2026-09-11: disclosed: CVE-2026-89736 published
- 2026-09-07: patched: Fix committed to stable branches