HIGH Introduced in 3.18
usbtv AudioCard UAF
CVE-2026-90032
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.6MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: media: usbtv: keep device alive while ALSA card exists The ALSA PCM callbacks store the driver state in pcm->private_data. An open PCM file can outlive USB disconnect because usbtv_audio_free() uses snd_card_free_when_closed(). The disconnect path can then drop the V4L2 device reference and free struct usbtv before ALSA releases the substream, so a later close dereferences freed memory in snd_usbtv_pcm_close(). Take a V4L2 device reference for the ALSA card and drop it from the card private_free callback. This keeps struct usbtv valid until ALSA has closed the remaining files and freed the card.
02KernelScan AI Analysis
Risk summary
A use-after-free in the USB TV audio driver can be triggered by physically unplugging a USB TV device while its audio stream is open. An attacker with physical access to the USB port could exploit this to crash the kernel or potentially achieve code execution. Systems without exposed USB ports or with sealed enclosures are not at risk.
Vulnerability analysis
When a USB TV device is disconnected while its audio stream is still open, the driver tears down the device's internal state before the sound subsystem has finished using it. The ALSA card is configured to persist until all open sound files are closed, but the underlying USB device structure is released immediately on disconnect, leaving a dangling pointer in the audio callback data. Closing the audio file afterwards dereferences that freed memory. The fix takes an extra reference on the V4L2 device when the ALSA card is created and releases it only when the card is fully torn down, keeping the structure valid for as long as any audio file remains open. The vulnerability requires a USB TV device to be present and physically unplugged while someone has its audio device open, so an attacker needs physical access to the USB port.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 3.18 | 7.2.5 | 1618257cb0ab |
| 6.12 | 3.18 | 6.12.110 | 239d1683e08b |
| 5.15 | 3.18 | 5.15.221 | 503be26ff888 |
| 6.6 | 3.18 | 6.6.157 | 67374e3a0081 |
| 6.18 | 3.18 | 6.18.51 | 7690a86b1932 |
| 5.10 | 3.18 | 5.10.270 | 97b5e8b22b98 |
| 6.1 | 3.18 | 6.1.188 | be0f7745f883 |
| mainline | 3.18 | 7.3-rc1 | fc530fe168bb |
| cip/6.12 | 3.18 | 6.12.111-cip32 | 239d1683e08b |