EUVD-2026-80490
GHSA-qhgv-8fw2-7hch
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access to device/PCM nodes (AV:L, PR:L); success needs a PCM-held teardown race (AC:H); UAF is DoS-dominant (A:H) with only bounded, uncertain C/I impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
media: go7007: defer the ALSA v4l2 put until card release
go7007_snd_init() already takes a v4l2_device reference for the ALSA side, but go7007_snd_remove() drops it immediately after calling snd_card_free_when_closed().
That is too early when a userspace process still has the capture PCM open. The ALSA card and its PCM callbacks remain alive until the last file is closed, so the release path can still reach struct go7007 through pcm->private_data and call go7007_snd_hw_free() after the V4L2 release path has freed the object.
Move the matching v4l2_device_put() to the ALSA card private_free callback so the existing ALSA reference covers the whole deferred card lifetime.
AnalysisAI
A use-after-free in the Linux kernel's go7007 media driver allows a local user who can open the driver's ALSA capture PCM node to trigger memory corruption by keeping that PCM file open across a device removal or unbind event (for example, a USB unplug). The flaw is a lifetime mismatch: go7007_snd_remove() releases the v4l2_device reference immediately after snd_card_free_when_closed(), even though the ALSA card - and its PCM callbacks reaching struct go7007 through pcm->private_data - can stay alive until the last file is closed, so go7007_snd_hw_free() may run against an already-freed object. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the WIS GO7007 media driver bound to real go7007 capture hardware, a local user able to open its ALSA capture PCM node, and that PCM file kept open across a device-removal/unbind event (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a locally-triggered use-after-free in the Linux kernel go7007 media driver's ALSA/V4L2 teardown path, not a remotely reachable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches: apply the go7007 lifetime fix by updating to Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 or later (7.3-rc1 for mainline), which move the v4l2_device_put() into the ALSA card private_free callback; per-branch fix commits are linked from the kernel.org stable references in this advisory and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-89890) provides the authoritative record. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory any Linux endpoints, appliances, or lab systems with WIS GO7007-based USB capture hardware installed and confirm whether non-privileged local users can access the ALSA capture PCM node; if such systems cannot be identified quickly, treat unknown hosts running the go7007 module as in-scope and restrict local logon and physical access to them. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today