{"id":"AZL-101586","summary":"CVE-2026-90032 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: usbtv: keep device alive while ALSA card exists\n\nThe ALSA PCM callbacks store the driver state in pcm-\u003eprivate_data. An\nopen PCM file can outlive USB disconnect because usbtv_audio_free() uses\nsnd_card_free_when_closed(). The disconnect path can then drop the V4L2\ndevice reference and free struct usbtv before ALSA releases the substream,\nso a later close dereferences freed memory in snd_usbtv_pcm_close().\n\nTake a V4L2 device reference for the ALSA card and drop it from the card\nprivate_free callback. This keeps struct usbtv valid until ALSA has closed\nthe remaining files and freed the card.","modified":"2026-09-18T05:37:08Z","published":"2026-09-16T11:17:16Z","upstream":["CVE-2026-90032"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90032"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-101586.json"}}],"schema_version":"1.9.0"}