Use-after-free in Linux kernel - CVE-2026-98266
Published: October 7, 2026
Vulnerability identifier: #VU153761
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98266
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a use-after-free.
The vulnerability exists due to improper device lifetime management in ALSA core (sound/core/init.c) when releasing a sound card asynchronously. A local user can trigger asynchronous card release while in-flight tasks still access the underlying card device to cause a use-after-free.
The disconnection operation gates new accesses but does not prevent access by tasks already in progress.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98266
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1