https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 22:20:30 +0000 https://cve.radiocsirt.org/vuln/cve-2026-98266 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: core: Fix potential UAF after asynchronous card release</p> <p>Usually a sound driver releases the resources assigned to the card via snd_card_free(), and it synchronizes with the whole release procedure. However, when the card is released asynchronously via snd_card_free_when_closed() like USB-audio driver, the situation is slightly different; although the snd_card_disconnect() call at the disconnection guarantees that any newer accesses will be gated, the in-flight tasks might be still accessing to the underlying card-&gt;dev device even after the disconnection, which would cause a use-after-free in the end, as reported by fuzzers.</p> <p>For addressing the bug above, this patch takes the refcount of card-&gt;dev at initialization of the card object, and releases at its destructor. This assures the availability of the card-&gt;dev in its whole lifecycle.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: core: Fix potential UAF after asynchronous card release</p> <p>Usually a sound driver releases the resources assigned to the card via snd_card_free(), and it synchronizes with the whole release procedure. However, when the card is released asynchronously via snd_card_free_when_closed() like USB-audio driver, the situation is slightly different; although the snd_card_disconnect() call at the disconnection guarantees that any newer accesses will be gated, the in-flight tasks might be still accessing to the underlying card-&gt;dev device even after the disconnection, which would cause a use-after-free in the end, as reported by fuzzers.</p> <p>For addressing the bug above, this patch takes the refcount of card-&gt;dev at initialization of the card object, and releases at its destructor. This assures the availability of the card-&gt;dev in its whole lifecycle.</p> https://cve.radiocsirt.org/vuln/cve-2026-98266