Use-After-Free Vulnerability in Linux Kernel ALSA Loopback Audio Driver

CVE-2026-46090

What is CVE-2026-46090?

A Use-After-Free vulnerability exists in the ALSA loopback audio driver of the Linux kernel, specifically in the handling of playback and capture channels. The flaw arises during format changes when the playback begins with mismatched parameters to the ongoing capture stream. This scenario can lead to a stale pointer being dereferenced if concurrent actions occur, potentially causing system instability or crashes. To mitigate this, modifications have been implemented to ensure proper management of peer runtime lifecycles, ensuring that the system maintains stability during playback and capture stream transitions.

References