{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-90198 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-90198 is an use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-90198 and fix it if it is affected.\n\nWhat it is: CVE-2026-90198 is an use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-90198 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-90198/ (Markdown: https://insights.sbomify.com/CVE-2026-90198/index.md)","id":"CVE-2026-90198","markdown":"https://insights.sbomify.com/CVE-2026-90198/index.md","name":"CVE-2026-90198","record":{"aliases":["AZL-102738","BELL-CVE-2026-90198","DEBIAN-CVE-2026-90198","GHSA-89m9-vw2h-xgxr","UBUNTU-CVE-2026-90198"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel ALSA","requires_auth":"low_privilege","summary":"A local attacker with an open sound card file descriptor can trigger a use-after-free in the Linux kernel ALSA subsystem, potentially leading to privilege escalation or code execution.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: core: Fix use-after-free in snd_card_do_free()\n\nA use-after-free was detected in snd_card_do_free() when a sound card\nmanaged by devres is unbound while a user-space application still holds an\nopen file descriptor.\n\nFor managed cards, the memory is allocated using devres_alloc(), and its\nrelease function is set to __snd_card_release(), which calls\nsnd_card_free(). When the device is unbound, the unbind thread calls\nsnd_card_free(), which drops a reference to the card's device. If the user\nthread still has an open file descriptor, the reference count does not\nreach zero, and the unbind thread blocks on wait_for_completion(\u0026released).\n\nWhen the user thread closes the file descriptor, it drops the final\nreference, invoking the device release callback release_card_device(),\nwhich calls snd_card_do_free(). snd_card_do_free() performs cleanup and\ncalls complete(card-\u003erelease_completion). This wakes up the unbind thread,\nwhich returns from snd_card_free() and __snd_card_release(). The devres\ncore then immediately frees the memory block containing the snd_card\nstructure.\n\nMeanwhile, the user thread continues execution in snd_card_do_free() and\nevaluates `if (!card-\u003emanaged)`. It reads the `managed` boolean from the\nsnd_card structure that was just freed by the unbind thread, triggering a\nKASAN use-after-free.\n\nFix this by caching the value of card-\u003emanaged in a local variable before\ncalling complete(). This ensures that the card pointer is not dereferenced\nafter the unbind thread has been woken up and potentially freed the card.\n\nBUG: KASAN: use-after-free in snd_card_do_free sound/core/init.c:604\n[inline]\nBUG: KASAN: use-after-free in release_card_device+0x1ab/0x1b0\nsound/core/init.c:153\nRead of size 1 at addr ffff8881912ec909 by task syz-executor130/5857\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120\n print_address_description+0x55/0x1e0 mm/kasan/report.c:378\n print_report+0x58/0x70 mm/kasan/report.c:482\n kasan_report+0x117/0x150 mm/kasan/report.c:595\n snd_card_do_free sound/core/init.c:604 [inline]\n release_card_device+0x1ab/0x1b0 sound/core/init.c:153\n device_release+0xc4/0x1f0 drivers/base/core.c:-1\n kobject_cleanup lib/kobject.c:689 [inline]\n kobject_release lib/kobject.c:720 [inline]\n kref_put include/linux/kref.h:65 [inline]\n kobject_put+0x222/0x550 lib/kobject.c:737\n snd_card_file_remove+0x331/0x390 sound/core/init.c:1125\n snd_pcm_release+0x12c/0x160 sound/core/pcm_native.c:2986\n __fput+0x418/0xa50 fs/file_table.c:512\n fput_close_sync+0x11f/0x240 fs/file_table.c:617\n __do_sys_close fs/open.c:1511 [inline]\n __se_sys_close fs/open.c:1496 [inline]\n __x64_sys_close+0x7e/0x110 fs/open.c:1496\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ALSA: core: Fix use-after-free in snd_card_do_free()","id":"CVE-2026-90198","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":7,"next":{"headline":"fs/ntfs3: reject out-of-range evcn in mi_enum_attr()","id":"CVE-2026-90199"},"packages":[],"prev":{"headline":"HID: haptic: don't write an uninitialized value to unhandled usages","id":"CVE-2026-90197"},"products":["Linux"],"published":"2026-09-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A local attacker with an open sound card file descriptor can trigger a use-after-free in the Linux kernel ALSA subsystem, potentially leading to privilege escalation or code execution.","url":"https://insights.sbomify.com/CVE-2026-90198/"}