Description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: aloop: Fix peer runtime UAF during format-change stop
loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture stream. Commit 826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved the peer lookup under cable->lock, but the actual snd_pcm_stop() still runs after dropping that lock.
A concurrent close can clear the capture entry from cable->streams[] and detach or free its runtime while the playback trigger path still holds a stale peer substream pointer.
Keep a per-cable count of in-flight peer stops before dropping cable->lock, and make free_cable() wait for those stops before detaching the runtime. This preserves the existing behavior while making the peer runtime lifetime explicit.
Metrics
CVSS 3.1 7.8/10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 597603d615d2b19a9e451d8cfac24372856a522d, < 83bd62fa9620ac98d5d694bde14c50f98c8e7189; >= 597603d615d2b19a9e451d8cfac24372856a522d, < 345c24b2bcf0923dfae1ab41497351c68214ff76; >= 597603d615d2b19a9e451d8cfac24372856a522d, < 3727a3541788412c393eec236ad228d72efe19c7; >= 597603d615d2b19a9e451d8cfac24372856a522d, < d258cdce50ff3e02392917258e81a0ce9555c327; >= 597603d615d2b19a9e451d8cfac24372856a522d, < 03f52a9c170431e8f10e156b9dc0dae80b3e9198; >= 597603d615d2b19a9e451d8cfac24372856a522d, < bdd9503c3d222d2735b56c7a8b4422ccf3de6e5c; >= 597603d615d2b19a9e451d8cfac24372856a522d, < 5d45e34bf001344e2966dabca1897561bbc9e913; >= 597603d615d2b19a9e451d8cfac24372856a522d, < e5c33cdc6f402eab8abd36ecf436b22c9d3a8aff |
| Linux | Linux | 2.6.37 |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 6 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
References
- https://git.kernel.org/stable/c/03f52a9c170431e8f10e156b9dc0dae80b3e9198Patch
- https://git.kernel.org/stable/c/345c24b2bcf0923dfae1ab41497351c68214ff76Patch
- https://git.kernel.org/stable/c/3727a3541788412c393eec236ad228d72efe19c7
- https://git.kernel.org/stable/c/5d45e34bf001344e2966dabca1897561bbc9e913Patch
- https://git.kernel.org/stable/c/83bd62fa9620ac98d5d694bde14c50f98c8e7189Patch
- https://git.kernel.org/stable/c/bdd9503c3d222d2735b56c7a8b4422ccf3de6e5cPatch
- https://git.kernel.org/stable/c/d258cdce50ff3e02392917258e81a0ce9555c327
- https://git.kernel.org/stable/c/e5c33cdc6f402eab8abd36ecf436b22c9d3a8affPatch
- https://access.redhat.com/errata/RHSA-2026:27353
- https://access.redhat.com/errata/RHSA-2026:27354
- https://access.redhat.com/errata/RHSA-2026:30848
- https://access.redhat.com/errata/RHSA-2026:33215
- https://access.redhat.com/errata/RHSA-2026:33685
- https://access.redhat.com/errata/RHSA-2026:33899
- https://access.redhat.com/errata/RHSA-2026:33900
- https://access.redhat.com/errata/RHSA-2026:34094
- https://access.redhat.com/errata/RHSA-2026:34095
- https://access.redhat.com/errata/RHSA-2026:34443
- https://access.redhat.com/errata/RHSA-2026:35844
- https://access.redhat.com/errata/RHSA-2026:35863
- https://access.redhat.com/errata/RHSA-2026:35896
- https://access.redhat.com/errata/RHSA-2026:41236
- https://access.redhat.com/security/cve/CVE-2026-46090
- https://bugzilla.redhat.com/show_bug.cgi?id=2481980
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46090.json
Timeline
- Published
- May 27, 2026
- Last modified
- Oct 19, 2026
- NVD status
- Modified