{"id":"AZL-100683","summary":"CVE-2026-89736 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_audio: Fix use-after-free on sound card disconnect\n\ng_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound\ncard teardown and immediately frees the underlying struct snd_uac_chip\ncontext. However, snd_card_free_when_closed() returns asynchronously\nwhile ALSA control elements (kctls) remain open in userspace.\n\nWhen userspace control applications access or close these open file\ndescriptors, kctl callbacks attempt to dereference kctl-\u003eprivate_data\npointing to &uac-\u003ec_prm or &uac-\u003ep_prm within the freed uac structure,\nresulting in a use-after-free (UAF) memory corruption.\n\nFix this issue by deferring the destruction of struct snd_uac_chip until\nall references to the ALSA sound card are released. Register a custom\ncard-\u003eprivate_free callback (u_audio_card_free) during g_audio_setup()\nthat frees uac and its associated playback/capture request and ring\nbuffers only when the sound card reference count drops to zero.","modified":"2026-09-12T14:15:30.367514473Z","published":"2026-09-11T20:20:04Z","upstream":["CVE-2026-89736"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89736"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-100683.json"}}],"schema_version":"1.9.0"}