Linux Kernel ALSA aloop Peer Runtime UAF Fix
CVE-2026-46090 Published on May 27, 2026
ALSA: aloop: Fix peer runtime UAF during format-change stop
In the Linux kernel, the following vulnerability has been resolved:
ALSA: aloop: Fix peer runtime UAF during format-change stop
loopback_check_format() may stop the capture side when playback starts
with parameters that no longer match a running capture stream. Commit
826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved
the peer lookup under cable->lock, but the actual snd_pcm_stop() still
runs after dropping that lock.
A concurrent close can clear the capture entry from cable->streams[] and
detach or free its runtime while the playback trigger path still holds a
stale peer substream pointer.
Keep a per-cable count of in-flight peer stops before dropping
cable->lock, and make free_cable() wait for those stops before
detaching the runtime. This preserves the existing behavior while
making the peer runtime lifetime explicit.
Vulnerability Analysis
CVE-2026-46090 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Signal Handler Race Condition
The software uses a signal handler that introduces a race condition.
Products Associated with CVE-2026-46090
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-46090 are published in these products:
Affected Versions
Linux:- Version 597603d615d2b19a9e451d8cfac24372856a522d and below 83bd62fa9620ac98d5d694bde14c50f98c8e7189 is affected.
- Version 597603d615d2b19a9e451d8cfac24372856a522d and below 345c24b2bcf0923dfae1ab41497351c68214ff76 is affected.
- Version 597603d615d2b19a9e451d8cfac24372856a522d and below 03f52a9c170431e8f10e156b9dc0dae80b3e9198 is affected.
- Version 597603d615d2b19a9e451d8cfac24372856a522d and below bdd9503c3d222d2735b56c7a8b4422ccf3de6e5c is affected.
- Version 597603d615d2b19a9e451d8cfac24372856a522d and below 5d45e34bf001344e2966dabca1897561bbc9e913 is affected.
- Version 597603d615d2b19a9e451d8cfac24372856a522d and below e5c33cdc6f402eab8abd36ecf436b22c9d3a8aff is affected.
- Version 2.6.37 is affected.
- Before 2.6.37 is unaffected.
- Version 5.10.259, <= 5.10.* is unaffected.
- Version 5.15.210, <= 5.15.* is unaffected.
- Version 6.12.88, <= 6.12.* is unaffected.
- Version 6.18.27, <= 6.18.* is unaffected.
- Version 7.0.4, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.
- Version 0:6.12.0-211.29.1.el10_2 and below * is unaffected.
- Version 0:6.12.0-55.84.1.el10_0 and below * is unaffected.
- Version 0:3.10.0-1160.155.1.rt56.1307.el7 and below * is unaffected.
- Version 0:3.10.0-1160.154.1.el7 and below * is unaffected.
- Version 0:4.18.0-553.136.1.rt7.477.el8_10 and below * is unaffected.
- Version 0:4.18.0-553.136.1.el8_10 and below * is unaffected.
- Version 0:4.18.0-305.197.1.el8_4 and below * is unaffected.
- Version 0:4.18.0-305.197.1.el8_4 and below * is unaffected.
- Version 0:4.18.0-372.198.1.el8_6 and below * is unaffected.
- Version 0:4.18.0-372.198.1.el8_6 and below * is unaffected.
- Version 0:4.18.0-477.150.1.el8_8 and below * is unaffected.
- Version 0:4.18.0-477.150.1.el8_8 and below * is unaffected.
- Version 0:5.14.0-687.19.1.el9_8 and below * is unaffected.
- Version 0:5.14.0-284.178.1.el9_2 and below * is unaffected.
- Version 0:5.14.0-284.178.1.rt14.463.el9_2 and below * is unaffected.
- Version 0:5.14.0-427.135.1.el9_4 and below * is unaffected.
- Version 0:5.14.0-570.125.1.el9_6 and below * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.