HIGH Introduced in 3.10
go7007 SndCard UAF
CVE-2026-89890
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: media: go7007: defer the ALSA v4l2 put until card release go7007_snd_init() already takes a v4l2_device reference for the ALSA side, but go7007_snd_remove() drops it immediately after calling snd_card_free_when_closed(). That is too early when a userspace process still has the capture PCM open. The ALSA card and its PCM callbacks remain alive until the last file is closed, so the release path can still reach struct go7007 through pcm->private_data and call go7007_snd_hw_free() after the V4L2 release path has freed the object. Move the matching v4l2_device_put() to the ALSA card private_free callback so the existing ALSA reference covers the whole deferred card lifetime.
02KernelScan AI Analysis
Risk summary
A local user with access to the ALSA PCM device on a system with a go7007 USB video capture device can trigger a use-after-free by keeping the PCM open while the USB device is disconnected. The freed kernel object is then accessed through stale PCM callbacks when the audio stream is closed, potentially leading to kernel memory corruption, privilege escalation, or a system crash. Exploitation requires the go7007 driver to be loaded and local access to the audio device node.
Vulnerability analysis
In the go7007 USB video capture driver, the audio support takes a reference on the video device during initialization, but the removal path drops that reference too early—immediately after scheduling deferred destruction of the audio card. When a userspace process still has the capture device open, the audio card and its callbacks remain alive until the last file descriptor is closed, so the release path can still reach the driver structure through the stored pointer after the video side has freed it, resulting in a use-after-free. The fix delays the reference release until the audio card is fully destroyed, so the existing reference covers the entire deferred lifetime. This vulnerability is reachable by a local unprivileged user who can open the audio capture device, combined with a USB device disconnect that can be triggered either by physical removal or by a privileged software action.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.10 | 5.10.270 | 1c57d1a3396b |
| 5.15 | 3.10 | 5.15.221 | 9c4f9628b855 |
| 6.1 | 3.10 | 6.1.188 | b7a0de398ad5 |
| 6.12 | 3.10 | 6.12.110 | 29fe4d38fb59 |
| 6.18 | 3.10 | 6.18.51 | 0745a59945d9 |
| 6.6 | 3.10 | 6.6.157 | 1c9fdd946521 |
| 7.2 | 3.10 | 7.2.5 | e6f1a1ac9b8c |
| mainline | 3.10 | 7.3 | 1bd456afeb8a |
| cip/5.10 | 3.10 | 5.10.271-cip78 | 1c57d1a3396b |
| cip/6.1 | 3.10 | 6.1.189-cip61 | b7a0de398ad5 |
| cip/6.1-rt | 3.10 | 6.1.189-cip61-rt32 | b7a0de398ad5 |
| cip/6.12 | 3.10 | 6.12.111-cip32 | 29fe4d38fb59 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |