Към съдържанието
Търсене

CVE-2026-90198: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix use-after-free in snd_card_do_free() A use-after-free was detected in snd_card_do_free() when a sound card managed by devres is unbound while a user-space application still holds an open file descriptor. For managed cards, the memory is allocated using devres_alloc(), and its release function is set to __snd_card_release(), which calls snd_card_free(). When the device is unbound, the unbind thread calls snd_card_free(), which drops a reference to the card's device. If the user thread still has an open file descriptor, the reference count does not reach zero, and the unbind thread blocks on wait_for_completion(&released). When the user thread closes the file descriptor, it drops the final reference, invoking the device release callback release_card_device(), which calls snd_card_do_free(). snd_card_do_free() performs cleanup and calls complete(card->release_completion). This wakes up the unbind thread, which returns from snd_card_free() and __snd_card_release(). The devres core then immediately frees the memory block containing the snd_card structure. Meanwhile, the user thread continues execution in snd_card_do_free() and evaluates `if (!card->managed)`. It reads the `managed` boolean from the snd_card structure that was just freed by the unbind thread, triggering a KASAN use-after-free. Fix this by caching the value of card->managed in a local variable before calling complete(). This ensures that the card pointer is not dereferenced after the unbind thread has been woken up and potentially freed the card. BUG: KASAN: use-after-free in snd_card_do_free sound/core/init.c:604 [inline] BUG: KASAN: use-after-free in release_card_device+0x1ab/0x1b0 sound/core/init.c:153 Read of size 1 at addr ffff8881912ec909 by task syz-executor130/5857 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x5

    Засегнати продукти

    • Linux Linux: e8ad415b7a55cb9a9fbfc04696518d5ea0b609b3 преди d3d67f680dbc23a5e5e3d3ecfdbf700465809877; e8ad415b7a55cb9a9fbfc04696518d5ea0b609b3 преди 09b27dd01b98480334c10bf6fb8d41d5fb063a4b; e8ad415b7a55cb9a9fbfc04696518d5ea0b609b3 преди 03c5dabc8f16bc212a5b26d2425c03a55e55a86d; e8ad415b7a55cb9a9fbfc04696518d5ea0b609b3 преди 6da22efb5cf490b06ffbca32b10fc8af7654fee0; e8ad415b7a55cb9a9fbfc04696518d5ea0b609b3 преди a561012868ae37c28f61fdf658bf6f251bc0e8e8; e8ad415b7a55cb9a9fbfc04696518d5ea0b609b3 преди 7d9b5e86775fa97a487da08b9aa76e1674bf8868; e8ad415b7a55cb9a9fbfc04696518d5ea0b609b3 преди 5ae1a690c522fea2900ff56c8c2ace7b059f5e04
    • Linux Linux: 5.15; преди 5.15; 5.15.221 до 5.15.*; 6.1.188 до 6.1.*; 6.6.157 до 6.6.*; 6.12.110 до 6.12.*; 6.18.52 до 6.18.*; 7.2.6 до 7.2.*; от 7.3 нататък

    История

    • 17 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-90198: Linux | freedomonline.bg