Riskcovery

CVE-2026-46090

ALSA: aloop: Fix peer runtime UAF during format-change stop

State
Published
Severity
7.8 High
Published
May 27, 2026
Updated
Oct 19, 2026
Reserved
May 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: aloop: Fix peer runtime UAF during format-change stop

loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture stream. Commit 826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved the peer lookup under cable->lock, but the actual snd_pcm_stop() still runs after dropping that lock.

A concurrent close can clear the capture entry from cable->streams[] and detach or free its runtime while the playback trigger path still holds a stale peer substream pointer.

Keep a per-cable count of in-flight peer stops before dropping cable->lock, and make free_cable() wait for those stops before detaching the runtime. This preserves the existing behavior while making the peer runtime lifetime explicit.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
3.17.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hredhat-SADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 597603d615d2b19a9e451d8cfac24372856a522d to before 83bd62fa9620ac98d5d694bde14c50f98c8e7189Affected
  • 597603d615d2b19a9e451d8cfac24372856a522d to before 345c24b2bcf0923dfae1ab41497351c68214ff76Affected
  • 597603d615d2b19a9e451d8cfac24372856a522d to before 3727a3541788412c393eec236ad228d72efe19c7Affected
  • 597603d615d2b19a9e451d8cfac24372856a522d to before d258cdce50ff3e02392917258e81a0ce9555c327Affected
  • 597603d615d2b19a9e451d8cfac24372856a522d to before 03f52a9c170431e8f10e156b9dc0dae80b3e9198Affected
  • 597603d615d2b19a9e451d8cfac24372856a522d to before bdd9503c3d222d2735b56c7a8b4422ccf3de6e5cAffected
  • 597603d615d2b19a9e451d8cfac24372856a522d to before 5d45e34bf001344e2966dabca1897561bbc9e913Affected
  • 597603d615d2b19a9e451d8cfac24372856a522d to before e5c33cdc6f402eab8abd36ecf436b22c9d3a8affAffected
LinuxLinux
  • 2.6.37Affected
  • before 2.6.37Not affected
  • 5.10.259 through 5.10.*Not affected
  • 5.15.210 through 5.15.*Not affected
  • 6.1.188 through 6.1.*Not affected
  • 6.6.157 through 6.6.*Not affected
  • 6.12.88 through 6.12.*Not affected
  • 6.18.27 through 6.18.*Not affected
  • 7.0.4 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.