CVE-2026-43126

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Open Sound System (OSS) mixer component. This vulnerability arises when pending calls to kernel control operations are not properly handled during device disconnection, leading to potential Use-After-Free (UAF) scenarios. A local attacker could potentially exploit this to cause a denial of service or achieve arbitrary code execution.

A moderate impact use-after-free flaw was found in the Linux kernel's ALSA OSS mixer layer. The OSS mixer layer invokes kernel control (kcontrol) operations individually, and pending calls are not always caught when a sound device is disconnected, which can lead to a use-after-free condition. A local user with access to the OSS mixer interface could potentially exploit this race during sound card disconnection to cause a denial of service or, potentially, arbitrary code execution. Red Hat assessed this flaw as Moderate severity: exploitation requires local access with low privileges and depends on a timing window during device disconnection. Red Hat's CVSS:3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) differs from the upstream 7.8 score mainly in the assessed integrity impact. No Red Hat products are affected: all Red Hat Enterprise Linux 6 through 10 kernel and kernel-rt streams, as well as Red Hat In-Vehicle OS 2, are marked not affected because the vulnerable code is not present in the shipped kernels, so no Red Hat update is required.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.