CVE-2026-90032 Overview
CVE-2026-90032 is a use-after-free vulnerability in the Linux kernel usbtv media driver. The flaw resides in the interaction between the USB disconnect path and the ALSA PCM callback layer. An open PCM file can outlive the USB device disconnect because usbtv_audio_free() uses snd_card_free_when_closed(). The disconnect path drops the V4L2 device reference and frees struct usbtv before ALSA releases the substream. A later close operation then dereferences freed memory in snd_usbtv_pcm_close(), corrupting kernel memory.
Critical Impact
A local attacker holding an open PCM file descriptor to a usbtv audio device can trigger a use-after-free in kernel context when the USB device is disconnected, leading to potential local privilege escalation or kernel memory corruption.
Affected Products
- Linux kernel usbtv media driver (audio/ALSA component)
- Linux distributions shipping vulnerable stable kernel branches prior to the fix commits
- Systems with usbtv-compatible USB video capture hardware attached
Discovery Timeline
- 2026-09-16 - CVE-2026-90032 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90032
Vulnerability Analysis
The usbtv driver supports USB analog video capture devices and exposes both a V4L2 video interface and an ALSA audio interface. ALSA PCM callbacks store driver state in pcm->private_data, which points to the struct usbtv instance. Object lifetime management between these two subsystems is asymmetric and unsafe under disconnect.
When a userspace process holds a PCM substream open and the USB device is physically or logically disconnected, the driver invokes usbtv_audio_free(). That function calls snd_card_free_when_closed(), which defers the card teardown until the last file descriptor closes. However, the disconnect path continues to release the V4L2 device reference and free the containing struct usbtv immediately.
When userspace subsequently closes the substream, ALSA invokes snd_usbtv_pcm_close() against the now-freed memory. The dereference of pcm->private_data reads from a stale allocation, producing a classic use-after-free condition in kernel context.
Root Cause
The root cause is inconsistent reference counting between V4L2 and ALSA subsystems in the usbtv driver. snd_card_free_when_closed() correctly extends the ALSA card lifetime past the disconnect event, but no corresponding reference was held on the parent V4L2 device. The struct usbtv allocation is therefore freed while ALSA still holds pointers into it via pcm->private_data.
Attack Vector
Exploitation requires local access with permission to open the ALSA PCM device node for the usbtv audio interface. An attacker opens the PCM device, keeps the file descriptor open, then triggers or waits for a USB disconnect of the capture device. Closing the descriptor after disconnect reaches the vulnerable snd_usbtv_pcm_close() path and dereferences freed kernel memory. Successful exploitation can corrupt adjacent kernel objects and enable privilege escalation on systems where an attacker can influence USB device state.
No public proof-of-concept code is available. Refer to the upstream commits, including kernel commit 1618257c and kernel commit 239d1683, for the corrective patches.
Detection Methods for CVE-2026-90032
Indicators of Compromise
- Kernel oops or general protection fault referencing snd_usbtv_pcm_close in the call trace
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free reads inside the usbtv audio close path
- Unexpected kernel panics correlated with USB disconnect events for usbtv-family capture devices
Detection Strategies
- Inventory endpoints running Linux kernels that include the usbtv driver and identify hosts with attached USB analog capture hardware
- Correlate dmesg and journald records for usb 1-*: USB disconnect events immediately followed by ALSA-related oops messages
- Monitor for repeated open/close cycles against /dev/snd/pcmC*D*c device nodes bound to usbtv cards, which may indicate exploitation attempts
Monitoring Recommendations
- Forward kernel logs, USB subsystem events, and ALSA subsystem messages to a centralized logging pipeline for anomaly review
- Alert on any kernel crash signatures involving snd_usbtv_pcm_close, snd_pcm_release, or usbtv_audio_free
- Track unprivileged processes that open ALSA capture devices and remain resident across USB disconnect events
How to Mitigate CVE-2026-90032
Immediate Actions Required
- Apply the upstream Linux stable kernel updates that include the fix commits referenced by the CVE and reboot affected hosts
- Restrict physical and logical access to USB ports on multi-user systems to limit the ability to trigger disconnect events
- Remove or blacklist the usbtv kernel module on systems that do not require USB analog capture functionality
Patch Information
The fix takes a V4L2 device reference for the ALSA card and drops it in the card private_free callback. This keeps struct usbtv valid until ALSA has closed the remaining files and freed the card. The corrective changes are distributed across multiple stable branches. See kernel commit 503be26f, kernel commit 67374e3a, kernel commit 7690a86b, kernel commit 97b5e8b2, kernel commit be0f7745, and kernel commit fc530fe1 for the complete backport set.
Workarounds
- Blacklist the usbtv module by adding blacklist usbtv to /etc/modprobe.d/blacklist-usbtv.conf where the driver is unnecessary
- Restrict membership in the audio group and tighten permissions on /dev/snd/* device nodes to limit which local users can open PCM substreams
- Physically disconnect or avoid hot-plugging affected usbtv capture devices on shared or multi-user systems until patches are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
