CVE-2026-89736

A use-after-free (UAF) exists in the Linux kernel's USB gadget audio driver (u_audio): on gadget disconnect, g_audio_cleanup() immediately frees the driver's struct snd_uac_chip context even though the ALSA sound card teardown initiated by snd_card_free_when_closed() completes asynchronously while control elements are still open in userspace. If a userspace application subsequently accesses or closes those open ALSA control file descriptors, kernel kctl callbacks dereference pointers into the already-freed uac structure, corrupting freed kernel memory. The issue is rated high severity (CVSS 3.1: 7.8, local attack vector, low privileges required), meaning a local low-privileged attacker who can race the disconnect against control access could plausibly achieve kernel memory corruption leading to privilege escalation or a system crash. Exposure is limited to systems that actually configure the kernel's USB gadget audio function — for example embedded boards, single-board computers in USB gadget mode, or devices acting as USB audio accessories — since standard desktops and servers without gadget audio are unaffected. No public proof of concept, known in-the-wild exploitation, or CISA KEV listing exists; the fix defers freeing the chip structure until the sound card's reference count drops to zero via a custom card->private_free callback.

What to do: Update to a kernel release that includes the u_audio fix (which registers u_audio_card_free via card->private_free during g_audio_setup) as soon as your distribution ships it. On systems that cannot be patched immediately, avoid configuring the USB gadget audio function and unload the g_audio/u_audio modules if they are not needed. Audit which embedded or gadget-mode devices expose USB audio, restrict local untrusted user accounts on them, and monitor kernel logs for use-after-free splats originating from ALSA kctl callbacks.