Skip to main content

Linux Kernel CVE-2026-31581

| EUVDEUVD-2026-25474 HIGH
Use After Free (CWE-416)
2026-04-24 Linux GHSA-8wc2-723q-hf3g
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local authenticated user (AV:L/PR:L); the UAF is a disconnect-timing race requiring heap grooming, so AC:H; successful kernel memory corruption yields full C/I/A.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
6.3 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Generated
Jul 24, 2026 - 03:02 vuln.today
CVSS changed
Apr 27, 2026 - 20:37 NVD
7.8 (HIGH)
PoC Detected
Apr 27, 2026 - 20:28 vuln.today
Public exploit code
Patch released
Apr 27, 2026 - 20:28 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25474
CVE Published
Apr 24, 2026 - 14:42 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ALSA: 6fire: fix use-after-free on disconnect

In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_card_free_when_closed() is called and no file handles are open, the card and embedded chip are freed synchronously. The subsequent chip->card = NULL write then hits freed slab memory.

Call trace: usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline] usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182 usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458 ... hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953

Fix by moving the card lifecycle out of usb6fire_chip_abort() and into usb6fire_chip_disconnect(). The card pointer is saved in a local before any teardown, snd_card_disconnect() is called first to prevent new opens, URBs are aborted while chip is still valid, and snd_card_free_when_closed() is called last so chip is never accessed after the card may be freed.

AnalysisAI

Local privilege escalation via a use-after-free in the Linux kernel's ALSA driver for the TerraTec DMX 6Fire USB audio interface (sound/usb/6fire) lets a local attacker corrupt freed slab memory when the device is disconnected. The flaw is a CVSS 7.8 (CVSS:3.1 AV:L/PR:L) memory-corruption bug with publicly available proof-of-concept code, though EPSS is negligible (0.02%) and it is not on CISA KEV. usb6fire_chip_abort() writes chip->card = NULL after snd_card_free_when_closed() may have already freed the card-owned chip struct, giving an attacker a window to hijack freed kernel memory.

Technical ContextAI

The affected component is the USB sound driver for the TerraTec 6fire (DMX 6Fire) audio interface under sound/usb/6fire/chip.c in the Linux kernel's ALSA (Advanced Linux Sound Architecture) subsystem. The chip struct (struct sfire_chip) is embedded in the ALSA card's private data, allocated by snd_card_new() with sizeof(struct sfire_chip), so its lifetime is bound to the card object. This is a classic CWE-416 Use-After-Free: on disconnect, snd_card_free_when_closed() frees the card (and the embedded chip) synchronously when no file handles are open, but usb6fire_chip_abort() then dereferences and writes chip->card = NULL into that now-freed slab allocation. The CPE data identifies the affected product only as cpe:2.3:a:linux:linux, i.e. the mainline kernel, with the driver reachable whenever the 6fire USB device is (or can be) attached.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.12.83, 6.18.24, 6.19.14, or 7.0.1 or later - which relocates the card lifecycle from usb6fire_chip_abort() into usb6fire_chip_disconnect(), saving the card pointer locally, calling snd_card_disconnect() first, aborting URBs while the chip is still valid, and calling snd_card_free_when_closed() last. Distribution users should apply their vendor kernel update, e.g. Ubuntu per USN-8488-1 (https://ubuntu.com/security/notices/USN-8488-1); the upstream fix commits are at https://git.kernel.org/stable/c/af75b486f7e883e3422ece23c8d727e6815144a0 and related hashes. Where immediate patching is not possible, a targeted compensating control is to blacklist the snd-usb-6fire kernel module (e.g. modprobe blacklist) so the vulnerable driver never binds - the trade-off is loss of support for TerraTec 6Fire audio hardware, which is acceptable in the overwhelming majority of systems that do not use that device. Restricting physical/USB access to untrusted users also reduces the attack surface for the disconnect-triggered path.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31581 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy