CVE-2026-46090 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture stream. Commit 826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved the peer lookup under cable->lock, but the actual snd_pcm_stop() still runs after dropping that lock. A concurrent close can clear the capture entry from cable->streams[] and detach or free its runtime while the playback trigger path still holds a stale peer substream pointer. Keep a per-cable count of in-flight peer stops before dropping cable->lock, and make free_cable() wait for those stops before detaching the runtime. This preserves the existing behavior while making the peer runtime lifetime explicit.
A use-after-free vulnerability has been addressed in the Linux kernel's ALSA loopback driver. This issue arises during format changes in playback and capture streams. When playback begins with parameters that no longer align with an active capture stream, the loopback_check_format() function may inadvertently stop the capture. A recent commit attempted to fix this by moving the peer lookup under a lock, but the actual stop function still executed after releasing the lock. This created a race condition, allowing a concurrent close operation to remove the capture entry and free its runtime while playback was still referencing it. The vulnerability has been fixed by introducing a per-cable count of pending stops, ensuring that the runtime is only detached after all stops have been processed.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
| CWE-364 | Signal Handler Race Condition | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.37, < 5.10.259 >= 5.11, < 5.15.210 >= 5.16, < 6.12.88 >= 6.13, < 6.18.27 >= 6.19, < 7.0.4 7.1 rc1 |
CPE
Remediation
| |
Change History
14 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | kernel.org |
| Sep 14, 2026 | CVE Modified | redhat-SADP |
| Jul 20, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 7, 2026 | CVE Modified | redhat-SADP |
| Jul 6, 2026 | CVE Modified | redhat-SADP |
| Jul 2, 2026 | CVE Modified | redhat-SADP |
| Jul 1, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 19, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 30, 2026 | CVE Modified | kernel.org |
| May 27, 2026 | New CVE Received | kernel.org |