Answer in brief
CVE-2026-89736 records a Unknown severity vulnerability in usb: gadget: u_audio: Fix use-after-free on sound card disconnect. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=6c67ed9ad9b83e453e808f9b31a931a20a25629b <c74ff0b1a0fca53d3ac185873c87d6a719b30a47 || >=6c67ed9ad9b83e453e808f9b31a931a20a25629b <4e747c864a88537e18b1ffc19a1954c9686bb8e1 || >=6c67ed9ad9b83e453e808f9b31a931a20a25629b <79a92896e2bb9471550c56fc23d8d93592f04c27 || >=6c67ed9ad9b83e453e808f9b31a931a20a25629b <858965947081d10d41d9a1010a540d3d5eea958b || 3e016ef2e72da93a2ea7afbb45de1b481b44d761 || 3256e152b645fc1e788ba44c2d8ced690113e3e6 || 0eda2004f38d95ef5715d62be884cd344260535b || 33f341c1fc60e172a3515c51bdabee11e83d1ee9 || b131989797f7287d7fdadb2bababc05a15d44750 || 3bc7324e4911351e39c54a62e6ca46321cb10faf || 43ca70753dfffd517d2af126da28690f8f615605 || >=4.14.312 <4.15 || >=4.19.280 <4.20 || >=5.4.240 <5.5 || >=5.10.177 <5.11 || >=5.15.105 <5.16 || >=6.1.22 <6.2 || >=6.2.9 <6.3 | c74ff0b1a0fca53d3ac185873c87d6a719b30a47, 4e747c864a88537e18b1ffc19a1954c9686bb8e1, 79a92896e2bb9471550c56fc23d8d93592f04c27, 858965947081d10d41d9a1010a540d3d5eea958b, 4.15, 4.20, 5.5, 5.11, 5.16, 6.2, 6.3 |
| Linux/Linuxgeneric | 6.3 | Not reported |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix use-after-free on sound card disconnect g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound card teardown and immediately frees the underlying struct snd_uac_chip context. However, snd_card_free_when_closed() returns asynchronously while ALSA control elements (kctls) remain open in userspace. When userspace control applications access or close these open file descriptors, kctl callbacks attempt to dereference kctl->private_data pointing to &uac->c_prm or &uac->p_prm within the freed uac structure, resulting in a use-after-free (UAF) memory corruption. Fix this issue by deferring the destruction of struct snd_uac_chip until all references to the ALSA sound card are released. Register a custom card->private_free callback (u_audio_card_free) during g_audio_setup() that frees uac and its associated playback/capture request and ring buffers only when the sound card reference count drops to zero.
Quoted source text, attributed separately from HOL analysis.