CVE-2026-98266

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) subsystem. When an audio card is released asynchronously, such as during the disconnection of a USB sound device, active background tasks may continue accessing the device structure after it has been deallocated due to missing reference counting. A local user could exploit this use-after-free vulnerability to cause a system crash, leading to a Denial of Service (DoS), or potentially execute arbitrary code.

A race in the ALSA sound card lifecycle can leave in flight tasks accessing card dev after the underlying device has been released during asynchronous card destruction. The issue affects paths using snd_card_free_when_closed such as USB audio disconnect handling and can produce a use after free followed by a kernel crash. For the CVSS the PR:L value is used because a local user or process can access an ALSA device and keep operations in flight, although reliable triggering also depends on a concurrent device disconnect or removal event. AC:H reflects the race window between disconnect, asynchronous release, and an existing task that still uses card dev. The issue is not network reachable. Impact is at least a local denial of service via kernel crash and in the worst case may allow confidentiality, integrity, or privilege impact if the freed device memory can be reclaimed and influenced before the stale access completes. This use after free should be reviewed manually because the exact access type and reclaim control determine whether exploitation can progress beyond denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.