CVE-2026-46090: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46090 Overview

CVE-2026-46090 is a use-after-free vulnerability in the Linux kernel's ALSA (Advanced Linux Sound Architecture) aloop loopback driver. The flaw resides in loopback_check_format(), which can stop the capture side when playback starts with parameters that no longer match a running capture stream. A concurrent close() operation can clear the capture entry from cable->streams[] and detach or free its runtime while the playback trigger path still holds a stale peer substream pointer. This race condition results in a use-after-free [CWE-416] on the peer runtime structure.

Critical Impact
Local attackers with access to ALSA loopback devices can trigger a kernel use-after-free, leading to memory corruption, denial of service, or potential local privilege escalation.

Affected Products

Linux kernel (ALSA aloop loopback driver)
Distributions shipping vulnerable kernel versions prior to the upstream fix
Systems with the snd-aloop module loaded and accessible to unprivileged users

Discovery Timeline

2026-05-27 - CVE-2026-46090 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46090

Vulnerability Analysis

The vulnerability exists in the ALSA loopback driver (sound/drivers/aloop.c). When playback begins with parameters that differ from an active capture stream, loopback_check_format() invokes snd_pcm_stop() on the peer capture substream to force a format renegotiation.

A prior commit, 826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger"), moved the peer lookup under cable->lock. However, the actual snd_pcm_stop() call still executes after that lock is released. This creates a window where a concurrent close on the capture side can clear the entry from cable->streams[] and free the runtime structure while the playback trigger path still references it.

Root Cause

The root cause is improper synchronization of peer substream lifetime across the loopback cable. The peer substream pointer is acquired under cable->lock, but the lock is dropped before snd_pcm_stop() operates on that pointer. No reference count or in-flight counter exists to prevent free_cable() from detaching the runtime while a peer stop is pending.

Attack Vector

A local user with permission to open /dev/snd/pcm* loopback devices can race playback format changes against capture close operations. By rapidly opening, configuring, and closing playback and capture substreams on the same loopback cable with mismatched parameters, an attacker can trigger the use-after-free. Exploitation requires local access and the snd-aloop module to be loaded.

The upstream fix introduces a per-cable counter tracking in-flight peer stops before cable->lock is dropped. free_cable() now waits for those stops to complete before detaching the runtime, making the peer runtime lifetime explicit.

Detection Methods for CVE-2026-46090

Indicators of Compromise

Kernel oops or panic messages referencing loopback_check_format, snd_pcm_stop, or snd_pcm_runtime in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the snd-aloop module
Unexpected segmentation faults or system instability on hosts with active ALSA loopback usage

Detection Strategies

Audit loaded kernel modules with lsmod | grep snd_aloop to identify exposure on production systems
Enable KASAN on test and staging kernels to surface use-after-free conditions during fuzzing or stress testing
Correlate audio subsystem crashes with concurrent PCM open and close operations from unprivileged processes

Monitoring Recommendations

Forward kernel ring buffer logs (dmesg, journald) to a centralized logging platform and alert on BUG:, KASAN:, or Oops: strings referencing ALSA symbols
Monitor auditd for unexpected access patterns to /dev/snd/ devices by non-audio service accounts
Track kernel module load events to detect when snd-aloop is enabled in environments where it is not required

How to Mitigate CVE-2026-46090

Immediate Actions Required

Apply the upstream kernel patches referenced in the kernel.org commit logs as soon as your distribution publishes updated packages
Unload the snd-aloop module on systems that do not require ALSA loopback functionality using modprobe -r snd-aloop
Restrict access to /dev/snd/ device nodes to trusted users and audio service groups only

Patch Information

The fix is committed upstream in the Linux kernel stable tree. Reference commits include 03f52a9c1704, 5d45e34bf001, bdd9503c3d22, and e5c33cdc6f40. See the Linux Kernel Git Commit for the mainline fix. The patch adds a per-cable in-flight peer stop counter and requires free_cable() to wait for pending stops before detaching the runtime.

Workarounds

Blacklist the snd-aloop module via /etc/modprobe.d/blacklist-aloop.conf on systems that do not need software audio loopback
Limit /dev/snd/pcm* access through udev rules or filesystem permissions to reduce the local attack surface
Apply seccomp or AppArmor profiles to confine processes that interact with ALSA devices in multi-tenant environments

bash

# Configuration example: blacklist the snd-aloop module
echo "blacklist snd_aloop" | sudo tee /etc/modprobe.d/blacklist-aloop.conf
sudo modprobe -r snd_aloop
# Verify the module is no longer loaded
lsmod | grep snd_aloop