CVE-2026-89736: Linux Kernel USB Gadget Use-After-Free

CVE-2026-89736 Overview

CVE-2026-89736 is a use-after-free vulnerability in the Linux kernel's USB gadget audio driver (u_audio). The flaw resides in the sound card disconnect path, where g_audio_cleanup() frees the struct snd_uac_chip context immediately after calling snd_card_free_when_closed(). Because the sound card teardown completes asynchronously, ALSA control callbacks can still dereference kctl->private_data pointers into the freed uac structure. A local attacker with access to the ALSA control interface can trigger memory corruption on affected systems.

Critical Impact
Local attackers with access to USB gadget audio ALSA control devices can trigger kernel memory corruption, enabling potential privilege escalation or denial of service.

Affected Products

Linux kernel with USB gadget u_audio driver enabled
Systems exposing USB Audio Class gadget functionality (typically embedded and mobile Linux devices)
Distributions shipping kernels prior to the patched commits referenced below

Discovery Timeline

2026-09-11 - CVE-2026-89736 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89736

Vulnerability Analysis

The vulnerability exists in the USB gadget audio driver (drivers/usb/gadget/function/u_audio.c). During gadget cleanup, g_audio_cleanup() initiates asynchronous sound card teardown through snd_card_free_when_closed() and then frees the struct snd_uac_chip context (uac) without waiting for outstanding ALSA references.

ALSA control elements (kctls) registered by the driver retain pointers to &uac->c_prm and &uac->p_prm in their private_data field. If a userspace process still holds an open file descriptor to /dev/snd/controlCX, subsequent ioctl() calls or file close operations invoke kctl callbacks that dereference these dangling pointers. The result is a use-after-free (UAF) read or write against freed kernel heap memory.

Exploitation requires local access and permission to open the ALSA control device. Successful memory corruption in kernel context can lead to privilege escalation, information disclosure, or a kernel panic.

Root Cause

The root cause is a lifetime mismatch between the snd_uac_chip context and the ALSA sound card object. The driver freed the underlying context synchronously while asynchronous ALSA teardown left kctl callbacks holding references to it. No reference counting tied the uac allocation to the sound card's lifetime.

Attack Vector

A local user with access to the USB gadget audio sound card opens an ALSA control file descriptor and keeps it open. The attacker then triggers gadget disconnect (for example, by unbinding the USB gadget configuration). After g_audio_cleanup() frees the uac structure, the attacker issues control operations on the still-open descriptor, causing kctl callbacks to dereference freed memory.

The vulnerability requires local privileges and low attack complexity. No user interaction beyond the attacker's own actions is required. See the upstream patch on git.kernel.org for the exact code paths involved.

// No verified proof-of-concept code is publicly available.
// Refer to the Linux kernel patches for the corrected control-flow logic.

Detection Methods for CVE-2026-89736

Indicators of Compromise

Kernel oops or panic messages referencing snd_ctl_ioctl, snd_ctl_release, or u_audio functions in dmesg and /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in u_audio.c or ALSA control paths on kernels built with sanitizers
Unexpected process crashes or system instability correlated with USB gadget configuration changes

Detection Strategies

Audit installed kernel versions against the patched commits (4e747c8, 6f46762, 79a9289, 858965, 891a8d1, a7ecd1a, c74ff0b, f983793) referenced in the kernel.org stable tree
Monitor for local processes that open /dev/snd/controlC* file descriptors while interacting with USB gadget subsystems
Correlate USB gadget bind/unbind events (configfs writes under /sys/kernel/config/usb_gadget/) with subsequent kernel warnings

Monitoring Recommendations

Enable kernel logging at a verbosity that captures ALSA and USB gadget warning messages
Forward kernel logs to a centralized logging pipeline for retention and correlation analysis
Track privileged access to USB gadget configfs paths and ALSA control devices through Linux audit rules (auditctl -w /sys/kernel/config/usb_gadget/ -p wa)

How to Mitigate CVE-2026-89736

Immediate Actions Required

Apply the upstream Linux kernel patches from the stable tree that defer destruction of snd_uac_chip until all ALSA sound card references are released
Update to a distribution kernel that incorporates the fix and reboot affected systems
Restrict access to ALSA control devices and USB gadget configfs interfaces to trusted administrative users

Patch Information

The upstream fix registers a card->private_free callback (u_audio_card_free) during g_audio_setup() that frees the uac structure along with its playback and capture request and ring buffers only when the sound card reference count reaches zero. Patched commits are available in the Linux stable tree, including commit 4e747c8, commit 6f46762, commit 79a9289, commit 8589659, commit 891a8d1, commit a7ecd1a, commit c74ff0b, and commit f983793.

Workarounds

Disable the USB gadget audio function (g_audio / CONFIG_USB_CONFIGFS_F_UAC1 / CONFIG_USB_CONFIGFS_F_UAC2) on systems that do not require USB Audio Class gadget capability
Unbind or unload the u_audio module until the kernel patch is applied
Tighten permissions on /dev/snd/control* nodes and the USB gadget configfs hierarchy to prevent unprivileged users from triggering the disconnect path

bash

# Disable and unload the USB gadget audio function until patched
sudo sh -c 'echo "" > /sys/kernel/config/usb_gadget/g1/UDC' 2>/dev/null
sudo rmmod usb_f_uac2 usb_f_uac1 u_audio 2>/dev/null

# Restrict ALSA control device access to the audio group only
sudo chmod 0660 /dev/snd/controlC*
sudo chown root:audio /dev/snd/controlC*