CVE-2026-90198

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: core: Fix use-after-free in snd_card_do_free()

A use-after-free was detected in snd_card_do_free() when a sound card

managed by devres is unbound while a user-space application still holds an

open file descriptor.

For managed cards, the memory is allocated using devres_alloc(), and its

release function is set to __snd_card_release(), which calls

snd_card_free(). When the device is unbound, the unbind thread calls

snd_card_free(), which drops a reference to the card's device. If the user

thread still has an open file descriptor, the reference count does not

reach zero, and the unbind thread blocks on wait_for_completion(&released).

When the user thread closes the file descriptor, it drops the final

reference, invoking the device release callback release_card_device(),

which calls snd_card_do_free(). snd_card_do_free() performs cleanup and

calls complete(card->release_completion). This wakes up the unbind threa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References