Bug 2481980 (CVE-2026-46090) - CVE-2026-46090 kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop
Summary: CVE-2026-46090 kernel: ALSA: aloop: Fix peer runtime UAF during format-change...
Keywords:
Status: NEW
Alias: CVE-2026-46090
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-27 15:05 UTC by OSIDB Bzimport
Modified: 2026-07-09 20:39 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:27353 0 None None None 2026-06-19 16:51:16 UTC
Red Hat Product Errata RHSA-2026:27354 0 None None None 2026-06-19 16:29:44 UTC
Red Hat Product Errata RHSA-2026:30848 0 None None None 2026-06-29 04:56:22 UTC
Red Hat Product Errata RHSA-2026:33215 0 None None None 2026-06-29 19:24:00 UTC
Red Hat Product Errata RHSA-2026:33685 0 None None None 2026-06-30 19:04:59 UTC
Red Hat Product Errata RHSA-2026:33899 0 None None None 2026-07-01 00:15:56 UTC
Red Hat Product Errata RHSA-2026:33900 0 None None None 2026-07-01 00:13:40 UTC
Red Hat Product Errata RHSA-2026:34094 0 None None None 2026-07-01 08:59:10 UTC
Red Hat Product Errata RHSA-2026:34095 0 None None None 2026-07-01 08:41:01 UTC
Red Hat Product Errata RHSA-2026:34443 0 None None None 2026-07-01 19:15:16 UTC
Red Hat Product Errata RHSA-2026:35844 0 None None None 2026-07-06 04:20:45 UTC
Red Hat Product Errata RHSA-2026:35863 0 None None None 2026-07-06 04:51:33 UTC
Red Hat Product Errata RHSA-2026:35896 0 None None None 2026-07-06 14:26:47 UTC

Description OSIDB Bzimport 2026-05-27 15:05:25 UTC 
In the Linux kernel, the following vulnerability has been resolved:

ALSA: aloop: Fix peer runtime UAF during format-change stop

loopback_check_format() may stop the capture side when playback starts
with parameters that no longer match a running capture stream. Commit
826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved
the peer lookup under cable->lock, but the actual snd_pcm_stop() still
runs after dropping that lock.

A concurrent close can clear the capture entry from cable->streams[] and
detach or free its runtime while the playback trigger path still holds a
stale peer substream pointer.

Keep a per-cable count of in-flight peer stops before dropping
cable->lock, and make free_cable() wait for those stops before
detaching the runtime. This preserves the existing behavior while
making the peer runtime lifetime explicit.
Comment 1 Keith Grant 2026-05-27 17:04:43 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026052702-CVE-2026-46090-1211@gregkh/T
Comment 3 errata-xmlrpc 2026-06-19 16:29:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:27354 https://access.redhat.com/errata/RHSA-2026:27354
Comment 4 errata-xmlrpc 2026-06-19 16:51:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:27353 https://access.redhat.com/errata/RHSA-2026:27353
Comment 5 errata-xmlrpc 2026-06-29 04:56:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:30848 https://access.redhat.com/errata/RHSA-2026:30848
Comment 6 errata-xmlrpc 2026-06-29 19:23:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:33215 https://access.redhat.com/errata/RHSA-2026:33215
Comment 7 errata-xmlrpc 2026-06-30 19:04:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:33685 https://access.redhat.com/errata/RHSA-2026:33685
Comment 8 errata-xmlrpc 2026-07-01 00:13:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:33900 https://access.redhat.com/errata/RHSA-2026:33900
Comment 9 errata-xmlrpc 2026-07-01 00:15:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:33899 https://access.redhat.com/errata/RHSA-2026:33899
Comment 10 errata-xmlrpc 2026-07-01 08:41:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:34095 https://access.redhat.com/errata/RHSA-2026:34095
Comment 11 errata-xmlrpc 2026-07-01 08:59:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:34094 https://access.redhat.com/errata/RHSA-2026:34094
Comment 12 errata-xmlrpc 2026-07-01 19:15:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:34443 https://access.redhat.com/errata/RHSA-2026:34443
Comment 13 errata-xmlrpc 2026-07-06 04:20:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:35844 https://access.redhat.com/errata/RHSA-2026:35844
Comment 14 errata-xmlrpc 2026-07-06 04:51:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:35863 https://access.redhat.com/errata/RHSA-2026:35863
Comment 15 errata-xmlrpc 2026-07-06 14:26:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:35896 https://access.redhat.com/errata/RHSA-2026:35896
Note You need to log in before you can comment on or make changes to this bug.