Use-After-Free Vulnerability in Linux Kernel Affecting USB Audio Gadget

CVE-2026-89736

What is CVE-2026-89736?

A vulnerability in the Linux kernel relates to the USB audio gadget, specifically during the sound card teardown process. When the sound card is disconnected, g_audio_cleanup() calls snd_card_free_when_closed(), which frees the underlying structure, struct snd_uac_chip, immediately. This leads to a use-after-free scenario when applications in userspace attempt to access open ALSA control elements that reference the freed memory. To mitigate this, the fix defers the destruction of struct snd_uac_chip until all references to the ALSA sound card are released. By implementing a custom callback, the sound card resources will only be freed when the reference count drops to zero, preventing potential memory corruption issues.

References