GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23089 (GCVE-0-2026-23089)

Vulnerability from cvelistv5 – Published: 2026-02-04 16:08 – Updated: 2026-06-11 18:44
VLAI
Title
ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees mixer->id_elems but the controls already added to the card still reference the freed memory. Later when snd_card_register() runs, the OSS mixer layer calls their callbacks and hits a use-after-free read. Call trace: get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411 get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241 mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381 snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887 ... snd_card_register+0x4ed/0x6d0 sound/core/init.c:923 usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025 Fix by calling snd_ctl_remove() for all mixer controls before freeing id_elems. We save the next pointer first because snd_ctl_remove() frees the current element.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 20:40 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6639b6c2367f884ca172b78d69f7da17bfab2e5e , < 51b1aa6fe7dc87356ba58df06afb9677c9b841ea (git)
Affected: 6639b6c2367f884ca172b78d69f7da17bfab2e5e , < 56fb6efd5d04caf6f14994d51ec85393b9a896c6 (git)
Affected: 6639b6c2367f884ca172b78d69f7da17bfab2e5e , < 7009daeefa945973a530b2f605fe445fc03747af (git)
Affected: 6639b6c2367f884ca172b78d69f7da17bfab2e5e , < 7bff0156d13f0ad9436e5178b979b063d59f572a (git)
Affected: 6639b6c2367f884ca172b78d69f7da17bfab2e5e , < e6f103a22b08daf5df2f4aa158081840e5910963 (git)
Affected: 6639b6c2367f884ca172b78d69f7da17bfab2e5e , < dc1a5dd80af1ee1f29d8375b12dd7625f6294dad (git)
Affected: 6639b6c2367f884ca172b78d69f7da17bfab2e5e , < 930e69757b74c3ae083b0c3c7419bfe7f0edc7b2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.13
Unaffected: 0 , < 2.6.13 (semver)
Unaffected: 5.10.249 , ≤ 5.10.* (semver)
Unaffected: 5.15.199 , ≤ 5.15.* (semver)
Unaffected: 6.1.162 , ≤ 6.1.* (semver)
Unaffected: 6.6.122 , ≤ 6.6.* (semver)
Unaffected: 6.12.68 , ≤ 6.12.* (semver)
Unaffected: 6.18.8 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23089",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:33.270292Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:02.838Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/mixer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "51b1aa6fe7dc87356ba58df06afb9677c9b841ea",
              "status": "affected",
              "version": "6639b6c2367f884ca172b78d69f7da17bfab2e5e",
              "versionType": "git"
            },
            {
              "lessThan": "56fb6efd5d04caf6f14994d51ec85393b9a896c6",
              "status": "affected",
              "version": "6639b6c2367f884ca172b78d69f7da17bfab2e5e",
              "versionType": "git"
            },
            {
              "lessThan": "7009daeefa945973a530b2f605fe445fc03747af",
              "status": "affected",
              "version": "6639b6c2367f884ca172b78d69f7da17bfab2e5e",
              "versionType": "git"
            },
            {
              "lessThan": "7bff0156d13f0ad9436e5178b979b063d59f572a",
              "status": "affected",
              "version": "6639b6c2367f884ca172b78d69f7da17bfab2e5e",
              "versionType": "git"
            },
            {
              "lessThan": "e6f103a22b08daf5df2f4aa158081840e5910963",
              "status": "affected",
              "version": "6639b6c2367f884ca172b78d69f7da17bfab2e5e",
              "versionType": "git"
            },
            {
              "lessThan": "dc1a5dd80af1ee1f29d8375b12dd7625f6294dad",
              "status": "affected",
              "version": "6639b6c2367f884ca172b78d69f7da17bfab2e5e",
              "versionType": "git"
            },
            {
              "lessThan": "930e69757b74c3ae083b0c3c7419bfe7f0edc7b2",
              "status": "affected",
              "version": "6639b6c2367f884ca172b78d69f7da17bfab2e5e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/mixer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.13"
            },
            {
              "lessThan": "2.6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.249",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.249",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.68",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.8",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()\n\nWhen snd_usb_create_mixer() fails, snd_usb_mixer_free() frees\nmixer-\u003eid_elems but the controls already added to the card still\nreference the freed memory. Later when snd_card_register() runs,\nthe OSS mixer layer calls their callbacks and hits a use-after-free read.\n\nCall trace:\n  get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411\n  get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241\n  mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381\n  snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887\n  ...\n  snd_card_register+0x4ed/0x6d0 sound/core/init.c:923\n  usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025\n\nFix by calling snd_ctl_remove() for all mixer controls before freeing\nid_elems. We save the next pointer first because snd_ctl_remove()\nfrees the current element."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:59:47.264Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/51b1aa6fe7dc87356ba58df06afb9677c9b841ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/56fb6efd5d04caf6f14994d51ec85393b9a896c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/7009daeefa945973a530b2f605fe445fc03747af"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bff0156d13f0ad9436e5178b979b063d59f572a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6f103a22b08daf5df2f4aa158081840e5910963"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc1a5dd80af1ee1f29d8375b12dd7625f6294dad"
        },
        {
          "url": "https://git.kernel.org/stable/c/930e69757b74c3ae083b0c3c7419bfe7f0edc7b2"
        }
      ],
      "title": "ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23089",
    "datePublished": "2026-02-04T16:08:12.575Z",
    "dateReserved": "2026-01-13T15:37:45.962Z",
    "dateUpdated": "2026-06-11T18:44:02.838Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23089",
      "date": "2026-09-17",
      "epss": "0.0014",
      "percentile": "0.03725"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23089\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-04T17:16:19.780\",\"lastModified\":\"2026-06-17T10:20:51.850\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()\\n\\nWhen snd_usb_create_mixer() fails, snd_usb_mixer_free() frees\\nmixer-\u003eid_elems but the controls already added to the card still\\nreference the freed memory. Later when snd_card_register() runs,\\nthe OSS mixer layer calls their callbacks and hits a use-after-free read.\\n\\nCall trace:\\n  get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411\\n  get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241\\n  mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381\\n  snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887\\n  ...\\n  snd_card_register+0x4ed/0x6d0 sound/core/init.c:923\\n  usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025\\n\\nFix by calling snd_ctl_remove() for all mixer controls before freeing\\nid_elems. We save the next pointer first because snd_ctl_remove()\\nfrees the current element.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\\n\\nALSA: usb-audio: Correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n en snd_usb_mixer_free()\\n\\nCuando snd_usb_create_mixer() falla, snd_usb_mixer_free() libera mixer-\u0026gt;id_elems, pero los controles ya a\u00f1adidos a la tarjeta siguen referenciando la memoria liberada. M\u00e1s tarde, cuando se ejecuta snd_card_register(), la capa del mezclador OSS llama a sus retrollamadas y se produce una lectura de uso despu\u00e9s de liberaci\u00f3n.\\n\\nTraza de llamada:\\n  get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411\\n  get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241\\n  mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381\\n  snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887\\n  ...\\n  snd_card_register+0x4ed/0x6d0 sound/core/init.c:923\\n  usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025\\n\\nSe corrige llamando a snd_ctl_remove() para todos los controles del mezclador antes de liberar id_elems. Guardamos el siguiente puntero primero porque snd_ctl_remove() libera el elemento actual.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"sound/usb/mixer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6639b6c2367f884ca172b78d69f7da17bfab2e5e\",\"lessThan\":\"51b1aa6fe7dc87356ba58df06afb9677c9b841ea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6639b6c2367f884ca172b78d69f7da17bfab2e5e\",\"lessThan\":\"56fb6efd5d04caf6f14994d51ec85393b9a896c6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6639b6c2367f884ca172b78d69f7da17bfab2e5e\",\"lessThan\":\"7009daeefa945973a530b2f605fe445fc03747af\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6639b6c2367f884ca172b78d69f7da17bfab2e5e\",\"lessThan\":\"7bff0156d13f0ad9436e5178b979b063d59f572a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6639b6c2367f884ca172b78d69f7da17bfab2e5e\",\"lessThan\":\"e6f103a22b08daf5df2f4aa158081840e5910963\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6639b6c2367f884ca172b78d69f7da17bfab2e5e\",\"lessThan\":\"dc1a5dd80af1ee1f29d8375b12dd7625f6294dad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6639b6c2367f884ca172b78d69f7da17bfab2e5e\",\"lessThan\":\"930e69757b74c3ae083b0c3c7419bfe7f0edc7b2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"sound/usb/mixer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.249\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.199\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.162\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.122\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.68\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.8\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T20:40:33.270292Z\",\"id\":\"CVE-2026-23089\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.13\",\"versionEndExcluding\":\"5.10.249\",\"matchCriteriaId\":\"FF8E9F0D-F0AD-45F3-935B-FCC837066EC9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.199\",\"matchCriteriaId\":\"A247FBA6-BEB9-484F-B892-DD5517949CCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.162\",\"matchCriteriaId\":\"6579E0D4-0641-479D-A4C3-0EF618798C55\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.122\",\"matchCriteriaId\":\"8EAAE395-0162-4BAF-9AD5-E9AF3C869C4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.68\",\"matchCriteriaId\":\"52F38E19-0FDD-4992-9D6D-D4169D689598\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.8\",\"matchCriteriaId\":\"E65C6E79-7EBE-4C77-93F0-818CF5B38F4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/51b1aa6fe7dc87356ba58df06afb9677c9b841ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/56fb6efd5d04caf6f14994d51ec85393b9a896c6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7009daeefa945973a530b2f605fe445fc03747af\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7bff0156d13f0ad9436e5178b979b063d59f572a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/930e69757b74c3ae083b0c3c7419bfe7f0edc7b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dc1a5dd80af1ee1f29d8375b12dd7625f6294dad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6f103a22b08daf5df2f4aa158081840e5910963\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T07:18:42+00:00",
      "cve": "CVE-2026-23089",
      "id": "CVE-2026-23089",
      "initial_release_date": "2026-02-04T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23089.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-24T02:40:02Z",
      "cve": "CVE-2026-23089",
      "id": "CVE-2026-23089",
      "initial_release_date": "2026-02-05T00:24:46Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "423",
      "product_status:known_not_affected": "9",
      "product_status:recommended": "642",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23089",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23089.json",
      "version": "38"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23089\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:40:33.270292Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:37:25.707Z\"}}], \"cna\": {\"title\": \"ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6639b6c2367f884ca172b78d69f7da17bfab2e5e\", \"lessThan\": \"51b1aa6fe7dc87356ba58df06afb9677c9b841ea\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6639b6c2367f884ca172b78d69f7da17bfab2e5e\", \"lessThan\": \"56fb6efd5d04caf6f14994d51ec85393b9a896c6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6639b6c2367f884ca172b78d69f7da17bfab2e5e\", \"lessThan\": \"7009daeefa945973a530b2f605fe445fc03747af\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6639b6c2367f884ca172b78d69f7da17bfab2e5e\", \"lessThan\": \"7bff0156d13f0ad9436e5178b979b063d59f572a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6639b6c2367f884ca172b78d69f7da17bfab2e5e\", \"lessThan\": \"e6f103a22b08daf5df2f4aa158081840e5910963\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6639b6c2367f884ca172b78d69f7da17bfab2e5e\", \"lessThan\": \"dc1a5dd80af1ee1f29d8375b12dd7625f6294dad\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6639b6c2367f884ca172b78d69f7da17bfab2e5e\", \"lessThan\": \"930e69757b74c3ae083b0c3c7419bfe7f0edc7b2\", \"versionType\": \"git\"}], \"programFiles\": [\"sound/usb/mixer.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.249\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.199\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.122\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.68\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"sound/usb/mixer.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/51b1aa6fe7dc87356ba58df06afb9677c9b841ea\"}, {\"url\": \"https://git.kernel.org/stable/c/56fb6efd5d04caf6f14994d51ec85393b9a896c6\"}, {\"url\": \"https://git.kernel.org/stable/c/7009daeefa945973a530b2f605fe445fc03747af\"}, {\"url\": \"https://git.kernel.org/stable/c/7bff0156d13f0ad9436e5178b979b063d59f572a\"}, {\"url\": \"https://git.kernel.org/stable/c/e6f103a22b08daf5df2f4aa158081840e5910963\"}, {\"url\": \"https://git.kernel.org/stable/c/dc1a5dd80af1ee1f29d8375b12dd7625f6294dad\"}, {\"url\": \"https://git.kernel.org/stable/c/930e69757b74c3ae083b0c3c7419bfe7f0edc7b2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()\\n\\nWhen snd_usb_create_mixer() fails, snd_usb_mixer_free() frees\\nmixer-\u003eid_elems but the controls already added to the card still\\nreference the freed memory. Later when snd_card_register() runs,\\nthe OSS mixer layer calls their callbacks and hits a use-after-free read.\\n\\nCall trace:\\n  get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411\\n  get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241\\n  mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381\\n  snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887\\n  ...\\n  snd_card_register+0x4ed/0x6d0 sound/core/init.c:923\\n  usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025\\n\\nFix by calling snd_ctl_remove() for all mixer controls before freeing\\nid_elems. We save the next pointer first because snd_ctl_remove()\\nfrees the current element.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.249\", \"versionStartIncluding\": \"2.6.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.199\", \"versionStartIncluding\": \"2.6.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.162\", \"versionStartIncluding\": \"2.6.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.122\", \"versionStartIncluding\": \"2.6.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.68\", \"versionStartIncluding\": \"2.6.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.8\", \"versionStartIncluding\": \"2.6.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19\", \"versionStartIncluding\": \"2.6.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T21:59:47.264Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-23089\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-11T18:44:02.838Z\", \"dateReserved\": \"2026-01-13T15:37:45.962Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-02-04T16:08:12.575Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.