CVE-2026-90032

A use-after-free flaw in the Linux kernel's usbtv driver, which handles USBTV007-class USB video capture dongles, can leave a freed driver structure referenced by an open ALSA PCM stream. If the USB device is disconnected while a PCM file is still open, the disconnect path drops the V4L2 device reference and frees struct usbtv, because usbtv_audio_free() uses snd_card_free_when_closed(); a later close of that PCM file then dereferences freed memory in snd_usbtv_pcm_close(). The fix takes a V4L2 device reference for the ALSA card and releases it from the card's private_free callback, keeping struct usbtv alive until ALSA has closed remaining files. A local attacker able to open the dongle's ALSA/V4L2 device nodes and trigger or race with a disconnect could crash the kernel or potentially achieve code execution with high confidentiality, integrity, and availability impact, consistent with the CVSS 7.8 local-attack vector. Only Linux systems with a kernel built with the usbtv driver and a supported capture dongle attached are affected, and no public proof-of-concept, known exploitation, or KEV listing exists.

What to do: Update to a kernel that includes the commit 'media: usbtv: keep device alive while ALSA card exists' or apply your distribution's backported stable/kernel security update when released. Check whether you are exposed with 'lsmod | grep usbtv'; systems without a USBTV007-class dongle are not affected. As an interim mitigation, restrict access to the relevant /dev/snd and /dev/video device nodes to trusted local users and avoid unplugging the dongle while audio streams are open.