Executive brief
The Linux kernel's ALSA (Advanced Linux Sound Architecture) audio subsystem contained a use-after-free vulnerability in sound card device cleanup. When a sound card was disconnected while user applications still had open file handles, a race condition could cause the system to read freed memory, potentially leading to system crashes or undefined behavior.
Technical details
The vulnerability exists in snd_card_do_free() within the ALSA core when handling device-resource-managed (devres) sound cards. A race condition occurs between the unbind thread and a user thread when closing an open file descriptor: the unbind thread frees the snd_card structure via devres after the user thread wakes it up via complete(), but the user thread continues execution and dereferences the now-freed card->managed field. The fix caches the managed flag value in a local variable before calling complete(), preventing post-free dereferencing. KASAN detected this as a read-after-free at sound/core/init.c:604.
Affected products
- Linux Linux kernel Affected versions not specified; patch applied to ALSA core/init.c
Timeline
- 2026-09-17: disclosed