GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89736 (GCVE-0-2026-89736)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-14 12:02
VLAI
Title
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix use-after-free on sound card disconnect g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound card teardown and immediately frees the underlying struct snd_uac_chip context. However, snd_card_free_when_closed() returns asynchronously while ALSA control elements (kctls) remain open in userspace. When userspace control applications access or close these open file descriptors, kctl callbacks attempt to dereference kctl->private_data pointing to &uac->c_prm or &uac->p_prm within the freed uac structure, resulting in a use-after-free (UAF) memory corruption. Fix this issue by deferring the destruction of struct snd_uac_chip until all references to the ALSA sound card are released. Register a custom card->private_free callback (u_audio_card_free) during g_audio_setup() that frees uac and its associated playback/capture request and ring buffers only when the sound card reference count drops to zero.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 33f341c1fc60e172a3515c51bdabee11e83d1ee9 , < a7ecd1a04f4f485d7be6443d0f0b2c61a800cb82 (git)
Affected: b131989797f7287d7fdadb2bababc05a15d44750 , < f983793f03148b097977f200298db215cd2d4438 (git)
Affected: 3bc7324e4911351e39c54a62e6ca46321cb10faf , < 6f46762196f04464e1050a9ee94e72b917db9010 (git)
Affected: 6c67ed9ad9b83e453e808f9b31a931a20a25629b , < 891a8d11f4d5eb50b2ce7570f4f98204a7a57493 (git)
Affected: 6c67ed9ad9b83e453e808f9b31a931a20a25629b , < c74ff0b1a0fca53d3ac185873c87d6a719b30a47 (git)
Affected: 6c67ed9ad9b83e453e808f9b31a931a20a25629b , < 4e747c864a88537e18b1ffc19a1954c9686bb8e1 (git)
Affected: 6c67ed9ad9b83e453e808f9b31a931a20a25629b , < 79a92896e2bb9471550c56fc23d8d93592f04c27 (git)
Affected: 6c67ed9ad9b83e453e808f9b31a931a20a25629b , < 858965947081d10d41d9a1010a540d3d5eea958b (git)
Affected: 3e016ef2e72da93a2ea7afbb45de1b481b44d761 (git)
Affected: 3256e152b645fc1e788ba44c2d8ced690113e3e6 (git)
Affected: 0eda2004f38d95ef5715d62be884cd344260535b (git)
Affected: 43ca70753dfffd517d2af126da28690f8f615605 (git)
Affected: 5.10.177 , < 5.10.270 (semver)
Affected: 5.15.105 , < 5.15.221 (semver)
Affected: 6.1.22 , < 6.1.188 (semver)
Affected: 4.14.312 , < 4.15 (semver)
Affected: 4.19.280 , < 4.20 (semver)
Affected: 5.4.240 , < 5.5 (semver)
Affected: 6.2.9 , < 6.3 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/u_audio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a7ecd1a04f4f485d7be6443d0f0b2c61a800cb82",
              "status": "affected",
              "version": "33f341c1fc60e172a3515c51bdabee11e83d1ee9",
              "versionType": "git"
            },
            {
              "lessThan": "f983793f03148b097977f200298db215cd2d4438",
              "status": "affected",
              "version": "b131989797f7287d7fdadb2bababc05a15d44750",
              "versionType": "git"
            },
            {
              "lessThan": "6f46762196f04464e1050a9ee94e72b917db9010",
              "status": "affected",
              "version": "3bc7324e4911351e39c54a62e6ca46321cb10faf",
              "versionType": "git"
            },
            {
              "lessThan": "891a8d11f4d5eb50b2ce7570f4f98204a7a57493",
              "status": "affected",
              "version": "6c67ed9ad9b83e453e808f9b31a931a20a25629b",
              "versionType": "git"
            },
            {
              "lessThan": "c74ff0b1a0fca53d3ac185873c87d6a719b30a47",
              "status": "affected",
              "version": "6c67ed9ad9b83e453e808f9b31a931a20a25629b",
              "versionType": "git"
            },
            {
              "lessThan": "4e747c864a88537e18b1ffc19a1954c9686bb8e1",
              "status": "affected",
              "version": "6c67ed9ad9b83e453e808f9b31a931a20a25629b",
              "versionType": "git"
            },
            {
              "lessThan": "79a92896e2bb9471550c56fc23d8d93592f04c27",
              "status": "affected",
              "version": "6c67ed9ad9b83e453e808f9b31a931a20a25629b",
              "versionType": "git"
            },
            {
              "lessThan": "858965947081d10d41d9a1010a540d3d5eea958b",
              "status": "affected",
              "version": "6c67ed9ad9b83e453e808f9b31a931a20a25629b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3e016ef2e72da93a2ea7afbb45de1b481b44d761",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3256e152b645fc1e788ba44c2d8ced690113e3e6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0eda2004f38d95ef5715d62be884cd344260535b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "43ca70753dfffd517d2af126da28690f8f615605",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.270",
              "status": "affected",
              "version": "5.10.177",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.221",
              "status": "affected",
              "version": "5.15.105",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.22",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.312",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.280",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.240",
              "versionType": "semver"
            },
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "6.2.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/u_audio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.10.177",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.15.105",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "6.1.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.312",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.280",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.240",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_audio: Fix use-after-free on sound card disconnect\n\ng_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound\ncard teardown and immediately frees the underlying struct snd_uac_chip\ncontext. However, snd_card_free_when_closed() returns asynchronously\nwhile ALSA control elements (kctls) remain open in userspace.\n\nWhen userspace control applications access or close these open file\ndescriptors, kctl callbacks attempt to dereference kctl-\u003eprivate_data\npointing to \u0026uac-\u003ec_prm or \u0026uac-\u003ep_prm within the freed uac structure,\nresulting in a use-after-free (UAF) memory corruption.\n\nFix this issue by deferring the destruction of struct snd_uac_chip until\nall references to the ALSA sound card are released. Register a custom\ncard-\u003eprivate_free callback (u_audio_card_free) during g_audio_setup()\nthat frees uac and its associated playback/capture request and ring\nbuffers only when the sound card reference count drops to zero."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached from local userspace: configfs UDC unbind calls afunc_unbind/f_audio_unbind \u2192 g_audio_cleanup, which frees snd_uac_chip while ALSA kctl/PCM fds still reference it; g_audio_setup runs at function bind with no USB host required, matching gadget teardown scores such as CVE-2024-38628.\nAC:L - The attacker controls both sides by issuing SNDRV_CTL_IOCTL_ELEM_READ/WRITE on the UAC mixer kctls while concurrently unbinding the gadget; snd_card_disconnect does not drain in-flight ioctls before g_audio_cleanup kfree()s the chip, so kctl get/put callbacks dereference freed uac_rtd_params and the race is freely retryable.\nPR:L - Android and embedded USB gadget HALs commonly delegate /sys/kernel/config/usb_gadget UDC writes to non-root service accounts, and the UAC gadget\u0027s ALSA control/PCM nodes are reachable by unprivileged local users; init-namespace root is not required once the gadget is deployed.\nUI:N - The attacker performs gadget unbind, holds ALSA fds, and issues mixer ioctls itself; no separate victim action such as plugging a cable or mounting a filesystem is required.\nS:U - The use-after-free corrupts kernel heap objects (snd_uac_chip and its playback/capture rings) within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Kctl get/info/tlv callbacks (u_audio_volume_get, u_audio_rate_get, u_audio_volume_tlv) read volume, rate, and TLV fields from the already-freed snd_uac_chip and copy them to userspace, yielding a use-after-free disclosure primitive that kernel scoring treats as High confidentiality.\nI:H - Kctl put callbacks (u_audio_volume_put, u_audio_mute_put, u_audio_pitch_put) take prm-\u003elock and write volume/mute/pitch into the kfree()\u0027d snd_uac_chip, providing a write-after-free primitive that can be turned into arbitrary write or control-flow hijack.\nA:H - Use of the freed snd_uac_chip, including spin_lock_irqsave on prm-\u003elock and USB ISO completions with req-\u003econtext pointing into the freed object, reliably produces KASAN reports, oops, and kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:02:23.539Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a7ecd1a04f4f485d7be6443d0f0b2c61a800cb82"
        },
        {
          "url": "https://git.kernel.org/stable/c/f983793f03148b097977f200298db215cd2d4438"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f46762196f04464e1050a9ee94e72b917db9010"
        },
        {
          "url": "https://git.kernel.org/stable/c/891a8d11f4d5eb50b2ce7570f4f98204a7a57493"
        },
        {
          "url": "https://git.kernel.org/stable/c/c74ff0b1a0fca53d3ac185873c87d6a719b30a47"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e747c864a88537e18b1ffc19a1954c9686bb8e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/79a92896e2bb9471550c56fc23d8d93592f04c27"
        },
        {
          "url": "https://git.kernel.org/stable/c/858965947081d10d41d9a1010a540d3d5eea958b"
        }
      ],
      "title": "usb: gadget: u_audio: Fix use-after-free on sound card disconnect",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89736",
    "datePublished": "2026-09-11T19:46:44.608Z",
    "dateReserved": "2026-09-11T19:38:34.761Z",
    "dateUpdated": "2026-09-14T12:02:23.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89736",
      "date": "2026-09-15",
      "epss": "0.00126",
      "percentile": "0.02605"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-15T01:53:25.000Z",
      "cve": "CVE-2026-89736",
      "id": "msrc_CVE-2026-89736",
      "initial_release_date": "2026-09-13T01:02:14.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "usb: gadget: u_audio: Fix use-after-free on sound card disconnect",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89736.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89736\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:20:04.077\",\"lastModified\":\"2026-09-14T13:19:22.700\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: gadget: u_audio: Fix use-after-free on sound card disconnect\\n\\ng_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound\\ncard teardown and immediately frees the underlying struct snd_uac_chip\\ncontext. However, snd_card_free_when_closed() returns asynchronously\\nwhile ALSA control elements (kctls) remain open in userspace.\\n\\nWhen userspace control applications access or close these open file\\ndescriptors, kctl callbacks attempt to dereference kctl-\u003eprivate_data\\npointing to \u0026uac-\u003ec_prm or \u0026uac-\u003ep_prm within the freed uac structure,\\nresulting in a use-after-free (UAF) memory corruption.\\n\\nFix this issue by deferring the destruction of struct snd_uac_chip until\\nall references to the ALSA sound card are released. Register a custom\\ncard-\u003eprivate_free callback (u_audio_card_free) during g_audio_setup()\\nthat frees uac and its associated playback/capture request and ring\\nbuffers only when the sound card reference count drops to zero.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/gadget/function/u_audio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"33f341c1fc60e172a3515c51bdabee11e83d1ee9\",\"lessThan\":\"a7ecd1a04f4f485d7be6443d0f0b2c61a800cb82\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b131989797f7287d7fdadb2bababc05a15d44750\",\"lessThan\":\"f983793f03148b097977f200298db215cd2d4438\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3bc7324e4911351e39c54a62e6ca46321cb10faf\",\"lessThan\":\"6f46762196f04464e1050a9ee94e72b917db9010\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6c67ed9ad9b83e453e808f9b31a931a20a25629b\",\"lessThan\":\"891a8d11f4d5eb50b2ce7570f4f98204a7a57493\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6c67ed9ad9b83e453e808f9b31a931a20a25629b\",\"lessThan\":\"c74ff0b1a0fca53d3ac185873c87d6a719b30a47\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6c67ed9ad9b83e453e808f9b31a931a20a25629b\",\"lessThan\":\"4e747c864a88537e18b1ffc19a1954c9686bb8e1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6c67ed9ad9b83e453e808f9b31a931a20a25629b\",\"lessThan\":\"79a92896e2bb9471550c56fc23d8d93592f04c27\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6c67ed9ad9b83e453e808f9b31a931a20a25629b\",\"lessThan\":\"858965947081d10d41d9a1010a540d3d5eea958b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3e016ef2e72da93a2ea7afbb45de1b481b44d761\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3256e152b645fc1e788ba44c2d8ced690113e3e6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0eda2004f38d95ef5715d62be884cd344260535b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"43ca70753dfffd517d2af126da28690f8f615605\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.177\",\"lessThan\":\"5.10.270\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.105\",\"lessThan\":\"5.15.221\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.22\",\"lessThan\":\"6.1.188\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.312\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.280\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.240\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.2.9\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/gadget/function/u_audio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4e747c864a88537e18b1ffc19a1954c9686bb8e1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6f46762196f04464e1050a9ee94e72b917db9010\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/79a92896e2bb9471550c56fc23d8d93592f04c27\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/858965947081d10d41d9a1010a540d3d5eea958b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/891a8d11f4d5eb50b2ce7570f4f98204a7a57493\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a7ecd1a04f4f485d7be6443d0f0b2c61a800cb82\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c74ff0b1a0fca53d3ac185873c87d6a719b30a47\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f983793f03148b097977f200298db215cd2d4438\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-13T06:47:11+00:00",
      "cve": "CVE-2026-89736",
      "id": "CVE-2026-89736",
      "initial_release_date": "2026-09-11T19:46:44.608000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel USB audio gadget driver: Use-after-free leading to arbitrary code execution",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89736.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-12T16:22:35Z",
      "cve": "CVE-2026-89736",
      "id": "CVE-2026-89736",
      "initial_release_date": "2026-09-12T16:22:35Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89736",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89736.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.