CVE-2026-89736

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_audio: Fix use-after-free on sound card disconnect

g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound

card teardown and immediately frees the underlying struct snd_uac_chip

context. However, snd_card_free_when_closed() returns asynchronously

while ALSA control elements (kctls) remain open in userspace.

When userspace control applications access or close these open file

descriptors, kctl callbacks attempt to dereference kctl->private_data

pointing to &uac->c_prm or &uac->p_prm within the freed uac structure,

resulting in a use-after-free (UAF) memory corruption.

Fix this issue by deferring the destruction of struct snd_uac_chip until

all references to the ALSA sound card are released. Register a custom

card->private_free callback (u_audio_card_free) during g_audio_setup()

that frees uac and its associated playback/capture request and ring

buffers only when the sound card reference

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References