Linux Kernel ALSA aloop Peer Runtime UAF Fix
CVE-2026-46090 Published on May 27, 2026

ALSA: aloop: Fix peer runtime UAF during format-change stop
In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture stream. Commit 826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved the peer lookup under cable->lock, but the actual snd_pcm_stop() still runs after dropping that lock. A concurrent close can clear the capture entry from cable->streams[] and detach or free its runtime while the playback trigger path still holds a stale peer substream pointer. Keep a per-cable count of in-flight peer stops before dropping cable->lock, and make free_cable() wait for those stops before detaching the runtime. This preserves the existing behavior while making the peer runtime lifetime explicit.

NVD

Vulnerability Analysis

CVE-2026-46090 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
HIGH
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Signal Handler Race Condition

The software uses a signal handler that introduces a race condition.


Products Associated with CVE-2026-46090

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-46090 are published in these products:

Linux Kernel
 
Red Hat Enterprise Linux Eus
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Rhel Aus
 
Red Hat Rhel Eus Long Life
 
Red Hat Rhel E4s
 
Canonical Ubuntu Linux
 
Red Hat Rhel Eus
 

Affected Versions

Linux: Linux: Red Hat Enterprise Linux AppStream EUS (v. 10.0): Red Hat Enterprise Linux AppStream (v. 10): Red Hat Enterprise Linux AppStream E4S (v.9.2): Red Hat Enterprise Linux AppStream E4S (v.9.4): Red Hat Enterprise Linux AppStream EUS (v.9.6): Red Hat Enterprise Linux AppStream (v. 9): Red Hat Enterprise Linux BaseOS EUS (v. 10.0): Red Hat Enterprise Linux BaseOS (v. 10): Red Hat Enterprise Linux BaseOS (v. 8): Red Hat Enterprise Linux BaseOS AUS (v.8.6): Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6): Red Hat Enterprise Linux BaseOS E4S (v.9.2): Red Hat Enterprise Linux BaseOS E4S (v.9.4): Red Hat Enterprise Linux BaseOS EUS (v.9.6): Red Hat Enterprise Linux BaseOS (v. 9): Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0): Red Hat Enterprise Linux CodeReady Linux Builder (v. 10): Red Hat Enterprise Linux CRB (v. 8): Red Hat CodeReady Linux Builder EUS (v.9.6): Red Hat Enterprise Linux CodeReady Linux Builder (v. 9): Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0): Red Hat Enterprise Linux Real Time for NFV (v. 10): Red Hat Enterprise Linux NFV (v. 8): Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2): Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4): Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6): Red Hat Enterprise Linux Real Time for NFV (v. 9): Red Hat Enterprise Linux Real Time EUS (v. 10.0): Red Hat Enterprise Linux Real Time (v. 10): Red Hat Enterprise Linux RT (v. 8): Red Hat Enterprise Linux Real Time E4S (v.9.2): Red Hat Enterprise Linux Real Time E4S (v.9.4): Red Hat Enterprise Linux Real Time EUS (v.9.6): Red Hat Enterprise Linux Real Time (v. 9): Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 6:

Exploit Probability

EPSS
0.13%
Percentile
2.82%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.