CVE-2026-23089 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and prioritize remediation. Additionally, operators managing Linux-based systems, platform administrators, vulnerability management teams, and security teams should also be aware of this vulnerability and its potential impacts.

Why it matters

The Linux kernel's ALSA usb-audio subsystem is vulnerable to a use-after-free attack, which can cause a use-after-free read when snd_card_register() runs and the OSS mixer layer calls their callbacks. Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and prioritize remediation.

• Verify Linux kernel versions to assess exposure
• Prioritize remediation based on Linux kernel updates
• Monitor Linux kernel security advisories for future vulnerabilities

Technical summary

The Linux kernel's ALSA usb-audio subsystem is vulnerable to a use-after-free attack. When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees mixer->id_elems but the controls already added to the card still reference the freed memory. This can cause a use-after-free read when snd_card_register() runs and the OSS mixer layer calls their callbacks. The vulnerability has been resolved by calling snd_ctl_remove() for all mixer controls before freeing id_elems.

Defensive priority

Medium

Recommended defensive actions

• Review Linux kernel versions and assess exposure
• Verify fixes by checking Linux kernel updates
• Monitor Linux kernel security advisories
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on the vulnerability. The Linux kernel's ALSA usb-audio subsystem is affected. The vulnerability has been resolved by calling snd_ctl_remove() for all mixer controls before freeing id_elems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.