EUVD-2026-76648
GHSA-hjw3-qcfv-9g4p
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
USB audio gadget mode is non-default (AC:H); local low-privilege access to ALSA device node needed (PR:L); kernel UAF yields full C/I/A impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound card teardown and immediately frees the underlying struct snd_uac_chip context. However, snd_card_free_when_closed() returns asynchronously while ALSA control elements (kctls) remain open in userspace.
When userspace control applications access or close these open file descriptors, kctl callbacks attempt to dereference kctl->private_data pointing to &uac->c_prm or &uac->p_prm within the freed uac structure, resulting in a use-after-free (UAF) memory corruption.
Fix this issue by deferring the destruction of struct snd_uac_chip until all references to the ALSA sound card are released. Register a custom card->private_free callback (u_audio_card_free) during g_audio_setup() that frees uac and its associated playback/capture request and ring buffers only when the sound card reference count drops to zero.
AnalysisAI
Use-after-free in the Linux kernel USB audio gadget driver (drivers/usb/gadget/function/u_audio.c) allows a local attacker or race condition to corrupt kernel memory when a USB audio gadget device is disconnected while userspace ALSA control file descriptors remain open. The root cause is that g_audio_cleanup() calls snd_card_free_when_closed() - which defers ALSA card teardown asynchronously - but immediately frees the underlying struct snd_uac_chip; kctl callbacks invoked when userspace closes those lingering FDs then dereference freed memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Linux system to be running in USB gadget mode with the USB audio gadget function (u_audio) active - this is a non-default, explicitly configured deployment (embedded devices, Raspberry Pi USB audio adapters, or similar). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 7.8 (AV:L/AC:L/PR:L) captures the local kernel UAF impact accurately in principle, but AC:L understates the real exploitation complexity: triggering the race requires a USB audio gadget to be actively connected and in use, userspace processes holding open ALSA kctl file descriptors, and a disconnect event racing with those open handles - a narrow timing window in a non-default configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released stable kernel patches: update to Linux 6.12.109 or later on the 6.12 LTS branch, 6.18.50 or later on the 6.18 branch, or 7.2.4 or later on the 7.x series. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and catalog systems with USB audio gadget driver functionality enabled in their kernel configuration (particularly embedded systems and audio appliances using g_audio). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today