Use-After-Free Vulnerability in Linux Kernel USB Audio Mixer Component
CVE-2026-23089

Currently unrated

Key Information:

Vendor: Linux
Status: Linux
Vendor: CVE Published:; 4 February 2026

What is CVE-2026-23089?

A vulnerability in the Linux kernel's USB audio mixer component has been identified, where the snd_usb_mixer_free() function can improperly reference freed memory. Specifically, if snd_usb_create_mixer() fails, the mixer controls retain a reference to memory that has been released. When the snd_card_register() function is called, it triggers callbacks from the OSS mixer layer that may lead to undefined behavior or system crashes due to accessing deallocated memory. To mitigate this issue, the fix involves ensuring that snd_ctl_remove() is called for all mixer controls prior to releasing the id_elems, preserving memory integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch