Executive brief
The go7007 media driver in the Linux kernel is used to capture video and audio from go7007-based USB devices. A race condition in the ALSA audio initialization allows the audio subsystem to access freed memory after the video device is released, potentially leading to a system crash or kernel panic when users keep audio streams open while disconnecting the device.
Technical details
The vulnerability is a use-after-free in the go7007 media driver's ALSA audio subsystem integration. The root cause is premature reference counting: go7007_snd_init() acquires a v4l2_device reference, but go7007_snd_remove() drops it immediately after calling snd_card_free_when_closed(), which only schedules the ALSA card for deferred release. If a userspace process holds the audio PCM device open, the ALSA card and its PCM callbacks remain alive, allowing the release path to invoke go7007_snd_hw_free() through pcm->private_data after the V4L2 object has been freed. The fix defers the v4l2_device_put() call to the ALSA card's private_free callback, ensuring the reference is held for the entire lifetime of the deferred card. This is a local attack vector requiring an active PCM stream; no network or privilege escalation is involved.
Affected products
- Linux Linux kernel multiple versions (go7007 driver)
Timeline
- 2026-09-16: disclosed: Vulnerability published on NVD
- 2026-07-15: patched: Upstream patch by Hans Verkuil (commit 1bd456afeb8a)
- 2026-09-11: patched: Stable tree backport by Greg Kroah-Hartman (commit 0745a59945d9)