ALSA: core: Fix use-after-free in snd_card_do_free()

{
  "id": "68a6f08ab7fac8bee93ff34a06d03f6e33cae4042e621507d2c641e937ab0ddc",
  "url": "https://osv.dev/vulnerability/CVE-2026-90198",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "ALSA: core: Fix use-after-free in snd_card_do_free()",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix use-after-free in snd_card_do_free() A use-after-free was detected in snd_card_do_free() when a sound card managed by devres is unbound while a user-space application still holds an open file descriptor. For managed cards, the memory is allocated using devres_alloc(), and its release function is set to __snd_card_release(), which calls snd_card_free(). When the device is unbound, the unbind thread calls snd_card_free(), which drops a reference to the card's device. If the user thread still has an open file descriptor, the reference count does not reach zero, and the unbind thread blocks on wait_for_completion(&released). When the user thread closes the file descriptor, it drops the final reference, invoking the device release callback release_card_device(), which calls snd_card_do_free(). snd_card_do_free() performs cleanup and calls complete(card->release_completion). This wakes up the unbind thread, which returns from snd_card_free() and __snd_card_release(). The devres core then immediately frees the memory block containing the snd_card structure. Meanwhile, the user thread continues execution in snd_card_do_free() and evaluates `if (!card->managed)`. It reads the `managed` boolean from the snd_card structure that was just freed by the unbind thread, triggering a KASAN use-after-free. Fix this by caching the value of card->managed in a local variable before calling complete(). This ensures ",
    "evidence": "osv:CVE-2026-90198",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.15.221",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.188",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.157",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.110",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.52",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.2.6",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-90198",
      "aliases": [
        "CVE-2026-90198"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "e8ad415b7a55cb9a9fbfc04696518d5ea0b609b3"
                },
                {
                  "fixed": "d3d67f680dbc23a5e5e3d3ecfdbf700465809877"
                },
                {
                  "fixed": "09b27dd01b98480334c10bf6fb8d41d5fb063a4b"
                },
                {
                  "fixed": "03c5dabc8f16bc212a5b26d2425c03a55e55a86d"
                },
                {
                  "fixed": "6da22efb5cf490b06ffbca32b10fc8af7654fee0"
                },
                {
                  "fixed": "a561012868ae37c28f61fdf658bf6f251bc0e8e8"
                },
                {
                  "fixed": "7d9b5e86775fa97a487da08b9aa76e1674bf8868"
                },
                {
                  "fixed": "5ae1a690c522fea2900ff56c8c2ace7b059f5e04"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90198.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.15.0"
                },
                {
                  "fixed": "5.15.221"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.188"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.157"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.110"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.52"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.2.6"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90198.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:29.072903362Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/03c5dabc8f16bc212a5b26d2425c03a55e55a86d",
        "https://git.kernel.org/stable/c/09b27dd01b98480334c10bf6fb8d41d5fb063a4b",
        "https://git.kernel.org/stable/c/5ae1a690c522fea2900ff56c8c2ace7b059f5e04",
        "https://git.kernel.org/stable/c/6da22efb5cf490b06ffbca32b10fc8af7654fee0",
        "https://git.kernel.org/stable/c/7d9b5e86775fa97a487da08b9aa76e1674bf8868",
        "https://git.kernel.org/stable/c/a561012868ae37c28f61fdf658bf6f251bc0e8e8",
        "https://git.kernel.org/stable/c/d3d67f680dbc23a5e5e3d3ecfdbf700465809877",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90198.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-90198",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90198.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-90198",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 495930,
  "published_at": "2026-09-17T16:07:16.923+00:00"
}