{"id":"AZL-77247","summary":"CVE-2026-23089 affecting package kernel for versions less than 6.6.126.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()\n\nWhen snd_usb_create_mixer() fails, snd_usb_mixer_free() frees\nmixer-\u003eid_elems but the controls already added to the card still\nreference the freed memory. Later when snd_card_register() runs,\nthe OSS mixer layer calls their callbacks and hits a use-after-free read.\n\nCall trace:\n  get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411\n  get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241\n  mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381\n  snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887\n  ...\n  snd_card_register+0x4ed/0x6d0 sound/core/init.c:923\n  usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025\n\nFix by calling snd_ctl_remove() for all mixer controls before freeing\nid_elems. We save the next pointer first because snd_ctl_remove()\nfrees the current element.","modified":"2026-08-28T17:47:38.040467596Z","published":"2026-02-04T17:16:19Z","upstream":["CVE-2026-23089"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23089"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.126.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-77247.json"}}],"schema_version":"1.9.0"}