CVE-2026-89736

A flaw was found in the Linux kernel's USB audio gadget driver (u_audio). This vulnerability occurs during sound card disconnection when Asynchronous Linux Sound Architecture (ALSA) control elements (kctls) remain open in userspace. A local attacker can exploit this timing issue by interacting with these kctls, leading to a use-after-free memory corruption. This could potentially result in arbitrary code execution or a denial of service.

This vulnerability is rated as Important because local unprivileged users could leverage the race condition during USB sound card teardown to corrupt kernel memory, potentially achieving privilege escalation or crashing the host. Under standard enterprise deployments, systems operate in USB host mode rather than device mode, and the USB gadget audio interface is neither configured nor enabled by default. Furthermore, the vulnerable code introduced in upstream stable kernels is not present in supported Red Hat Enterprise Linux releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.