CVE-2026-23089 ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
A use-after-free in the Linux kernel's USB audio driver allows attackers to cause a crash or potentially execute code via crafted USB devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23089?
CVE-2026-23089 is a high-severity use after free vulnerability in Linux kernel, published on 4 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees mixer->id_elems but the controls already added to the card still reference the freed memory. Later when snd_card_register() runs, the OSS mixer layer calls their callbacks and hits a use-after-free read.
Call trace: get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411 get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241 mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381 snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887 ... snd_card_register+0x4ed/0x6d0 sound/core/init.c:923 usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025
Fix by calling snd_ctl_remove() for all mixer controls before freeing id_elems. We save the next pointer first because snd_ctl_remove() frees the current element.
Weakness: CWE-416
Which versions are affected by CVE-2026-23089?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23089?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-23089 being exploited?
There is no known exploitation of CVE-2026-23089 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-77247, BELL-CVE-2026-23089, DEBIAN-CVE-2026-23089, GHSA-h8v3-969r-cfp9, ROOT-OS-UBUNTU-2204-CVE-2026-23089, ROOT-OS-UBUNTU-2404-CVE-2026-23089 and 1 more.