CVE-2026-23089

A use-after-free vulnerability was found in the Linux kernel's USB audio driver. When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees mixer->id_elems while controls already added to the sound card still reference this memory. When snd_card_register() later runs, the OSS mixer layer invokes callbacks on these controls, triggering a use-after-free read in get_ctl_value().

This use-after-free occurs during USB audio device probe error handling. Triggering requires a USB audio device that causes mixer creation to fail, which could happen with malformed device descriptors or resource exhaustion. The vulnerability results in a kernel crash or potential information disclosure through the stale memory read.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the snd_usb_audio module from being loaded if USB audio devices are not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.