CVE-2026-23089

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()

When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees

mixer->id_elems but the controls already added to the card still

reference the freed memory. Later when snd_card_register() runs,

the OSS mixer layer calls their callbacks and hits a use-after-free read.

Call trace:

get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411

get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241

mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381

snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887

...

snd_card_register+0x4ed/0x6d0 sound/core/init.c:923

usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025

Fix by calling snd_ctl_remove() for all mixer controls before freeing

id_elems. We save the next pointer first because snd_ctl_remove()

frees the current element.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References