---
id: CVE-2026-89736
title: 'usb: gadget: u_audio: Fix use-after-free on sound card disconnect'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: gadget: u_audio: Fix use-after-free on sound card disconnect

  g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound
  card teardown and immediately…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 33f341c1fc60e172a3515c51bdabee11e83d1ee9 <
    a7ecd1a04f4f485d7be6443d0f0b2c61a800cb82
  - >-
    Linux >= b131989797f7287d7fdadb2bababc05a15d44750 <
    f983793f03148b097977f200298db215cd2d4438
  - >-
    Linux >= 3bc7324e4911351e39c54a62e6ca46321cb10faf <
    6f46762196f04464e1050a9ee94e72b917db9010
  - >-
    Linux >= 6c67ed9ad9b83e453e808f9b31a931a20a25629b <
    891a8d11f4d5eb50b2ce7570f4f98204a7a57493
  - >-
    Linux >= 6c67ed9ad9b83e453e808f9b31a931a20a25629b <
    c74ff0b1a0fca53d3ac185873c87d6a719b30a47
  - >-
    Linux >= 6c67ed9ad9b83e453e808f9b31a931a20a25629b <
    4e747c864a88537e18b1ffc19a1954c9686bb8e1
  - >-
    Linux >= 6c67ed9ad9b83e453e808f9b31a931a20a25629b <
    79a92896e2bb9471550c56fc23d8d93592f04c27
  - >-
    Linux >= 6c67ed9ad9b83e453e808f9b31a931a20a25629b <
    858965947081d10d41d9a1010a540d3d5eea958b
  - Linux 3e016ef2e72da93a2ea7afbb45de1b481b44d761
  - Linux 3256e152b645fc1e788ba44c2d8ced690113e3e6
  - Linux 0eda2004f38d95ef5715d62be884cd344260535b
  - Linux 43ca70753dfffd517d2af126da28690f8f615605
  - Linux >= 5.10.177 < 5.10.270
  - Linux >= 5.15.105 < 5.15.221
  - Linux >= 6.1.22 < 6.1.188
  - Linux >= 4.14.312 < 4.15
  - Linux >= 4.19.280 < 4.20
  - Linux >= 5.4.240 < 5.5
  - Linux >= 6.2.9 < 6.3
  - Linux 6.3
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:51:50.340Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89736'
references:
  - url: 'https://git.kernel.org/stable/c/a7ecd1a04f4f485d7be6443d0f0b2c61a800cb82'
  - url: 'https://git.kernel.org/stable/c/f983793f03148b097977f200298db215cd2d4438'
  - url: 'https://git.kernel.org/stable/c/6f46762196f04464e1050a9ee94e72b917db9010'
  - url: 'https://git.kernel.org/stable/c/891a8d11f4d5eb50b2ce7570f4f98204a7a57493'
  - url: 'https://git.kernel.org/stable/c/c74ff0b1a0fca53d3ac185873c87d6a719b30a47'
  - url: 'https://git.kernel.org/stable/c/4e747c864a88537e18b1ffc19a1954c9686bb8e1'
  - url: 'https://git.kernel.org/stable/c/79a92896e2bb9471550c56fc23d8d93592f04c27'
  - url: 'https://git.kernel.org/stable/c/858965947081d10d41d9a1010a540d3d5eea958b'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89736.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89736'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532311'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89736'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89736'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89736.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00126
epssPercentile: 0.02278
scores:
  cna: 7.8
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.449Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_audio: Fix use-after-free on sound card disconnect

g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound
card teardown and immediately frees the underlying struct snd_uac_chip
context. However, snd_card_free_when_closed() returns asynchronously
while ALSA control elements (kctls) remain open in userspace.

When userspace control applications access or close these open file
descriptors, kctl callbacks attempt to dereference kctl->private_data
pointing to &uac->c_prm or &uac->p_prm within the freed uac structure,
resulting in a use-after-free (UAF) memory corruption.

Fix this issue by deferring the destruction of struct snd_uac_chip until
all references to the ALSA sound card are released. Register a custom
card->private_free callback (u_audio_card_free) during g_audio_setup()
that frees uac and its associated playback/capture request and ring
buffers only when the sound card reference count drops to zero.

## Affected

- `Linux >= 33f341c1fc60e172a3515c51bdabee11e83d1ee9 < a7ecd1a04f4f485d7be6443d0f0b2c61a800cb82`
- `Linux >= b131989797f7287d7fdadb2bababc05a15d44750 < f983793f03148b097977f200298db215cd2d4438`
- `Linux >= 3bc7324e4911351e39c54a62e6ca46321cb10faf < 6f46762196f04464e1050a9ee94e72b917db9010`
- `Linux >= 6c67ed9ad9b83e453e808f9b31a931a20a25629b < 891a8d11f4d5eb50b2ce7570f4f98204a7a57493`
- `Linux >= 6c67ed9ad9b83e453e808f9b31a931a20a25629b < c74ff0b1a0fca53d3ac185873c87d6a719b30a47`
- `Linux >= 6c67ed9ad9b83e453e808f9b31a931a20a25629b < 4e747c864a88537e18b1ffc19a1954c9686bb8e1`
- `Linux >= 6c67ed9ad9b83e453e808f9b31a931a20a25629b < 79a92896e2bb9471550c56fc23d8d93592f04c27`
- `Linux >= 6c67ed9ad9b83e453e808f9b31a931a20a25629b < 858965947081d10d41d9a1010a540d3d5eea958b`
- `Linux 3e016ef2e72da93a2ea7afbb45de1b481b44d761`
- `Linux 3256e152b645fc1e788ba44c2d8ced690113e3e6`
- `Linux 0eda2004f38d95ef5715d62be884cd344260535b`
- `Linux 43ca70753dfffd517d2af126da28690f8f615605`
- `Linux >= 5.10.177 < 5.10.270`
- `Linux >= 5.15.105 < 5.15.221`
- `Linux >= 6.1.22 < 6.1.188`
- `Linux >= 4.14.312 < 4.15`
- `Linux >= 4.19.280 < 4.20`
- `Linux >= 5.4.240 < 5.5`
- `Linux >= 6.2.9 < 6.3`
- `Linux 6.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89736.json)