PatchSiren cyber security CVE debrief

CVE-2026-46090 Linux CVE debrief

A use-after-free (UAF) vulnerability in the Linux kernel's ALSA loopback driver (aloop) could allow local attackers to trigger memory corruption. The flaw exists in loopback_check_format(), which may stop the capture side when playback starts with mismatched parameters. While a prior commit moved peer lookup under cable->lock, the snd_pcm_stop() call still executes after dropping that lock. A concurrent close can clear the capture entry from cable->streams[] and detach or free its runtime while the playback trigger path holds a stale peer substream pointer. The fix introduces a per-cable count of in-flight peer stops before dropping cable->lock, with free_cable() waiting for those stops before detaching the runtime.

Vendor: Linux
Product: Unknown
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-27
Original CVE updated: 2026-07-20
Advisory published: 2026-05-27
Advisory updated: 2026-07-20

Who should care

Linux system administrators, kernel maintainers, security teams managing multi-user Linux environments, and organizations relying on ALSA loopback functionality for audio routing or testing.

Technical summary

The ALSA loopback driver (sound/drivers/aloop.c) contains a race condition in loopback_check_format() where snd_pcm_stop() on a peer capture stream can execute after dropping cable->lock. If a concurrent close clears cable->streams[] and frees the capture runtime, the playback trigger path dereferences a stale peer substream pointer. The vulnerability is a use-after-free affecting kernel memory integrity. The fix adds a per-cable in-flight stop counter and makes free_cable() wait for pending stops, ensuring the peer runtime remains valid until all stop operations complete.

Defensive priority

high

Recommended defensive actions

Apply kernel patches from stable branches when available
Monitor distribution security advisories for updated kernel packages
Restrict local access to systems where untrusted users can access ALSA loopback devices
Review systems using audio loopback functionality for unusual stability issues
Consider disabling ALSA loopback module (snd-aloop) on systems where not required until patched

Evidence notes

Vulnerability description confirms UAF in ALSA aloop driver during format-change stop operations. Fix involves reference counting for in-flight peer stops to prevent race condition between snd_pcm_stop() and concurrent close operations.

Sources and references

Verified primary and authoritative sources

CVE-2026-46090 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-46090

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-46090 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46090

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/03f52a9c170431e8f10e156b9dc0dae80b3e9198

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/5d45e34bf001344e2966dabca1897561bbc9e913

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/bdd9503c3d222d2735b56c7a8b4422ccf3de6e5c

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/e5c33cdc6f402eab8abd36ecf436b22c9d3a8aff

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.