{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89890", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.773Z", "datePublished": "2026-09-16T10:31:53.276Z", "dateUpdated": "2026-09-16T14:39:41.154Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-16T14:39:41.154Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: go7007: defer the ALSA v4l2 put until card release\n\ngo7007_snd_init() already takes a v4l2_device reference for the ALSA\nside, but go7007_snd_remove() drops it immediately after calling\nsnd_card_free_when_closed().\n\nThat is too early when a userspace process still has the capture PCM open.\nThe ALSA card and its PCM callbacks remain alive until the last file is\nclosed, so the release path can still reach struct go7007 through\npcm->private_data and call go7007_snd_hw_free() after the V4L2 release path\nhas freed the object.\n\nMove the matching v4l2_device_put() to the ALSA card private_free callback\nso the existing ALSA reference covers the whole deferred card lifetime."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF is reached locally by holding the go7007 ALSA capture PCM open, forcing go7007_usb_disconnect() via USBDEVFS_DISCONNECT or sysfs unbind, then closing the PCM; there is no network path. Physical unplug is only an extra path, matching USB disconnect UAF scores (CVE-2026-80971, CVE-2025-40283).\nAC:L - The attacker fully controls the sequence: open the capture PCM, disconnect the already-bound device, then close. go7007_snd_remove() drops the ALSA v4l2 ref before snd_card_free_when_closed() finishes, so close deterministically hits hw_free/capture_close on the freed go7007 with no attacker-uncontrollable race.\nPR:L - Opening /dev/snd/pcmC*D*c has no capability check (audio group or seat/udev ACL), and USBDEVFS_DISCONNECT has no capable() gate, only write access to /dev/bus/usb that plugdev/uaccess grants seat users. Init-namespace root is not required.\nUI:N - The attacker performs PCM open, disconnect, and close on their own fds against an already-attached go7007 capture device (kiosk, industrial encoder, or shared workstation). No separate victim action such as plugging a cable or mounting a filesystem is required.\nS:U - The slab use-after-free of struct go7007 and the later ALSA PCM/card teardown run entirely in the host kernel. This is ordinary local privilege escalation, not a VM, IOMMU, or sandbox boundary escape.\nC:H - Per kernel UAF guidance confidentiality is High. After kfree(go), PCM close reads the dangling object (snd_pcm_substream_chip \u2192 go->snd_context and related fields); reclaiming that slab lets the attacker supply pointer-rich state and obtain a kernel disclosure primitive.\nI:H - go7007_snd_hw_free() writes audio_deliver on the freed go7007, capture_close() writes through go->snd_context, and go7007_snd_free() kfree()s that pointer. A reclaimed object yields write-after-free and arbitrary-free primitives suitable for control-flow hijack.\nA:H - Dereferencing the freed go7007 in PCM close/hw_free, and kfree of snd_context during deferred card free, reliably oopses or panics the kernel. The attacker can repeat disconnect/close to crash on demand, so availability impact is High."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/usb/go7007/snd-go7007.c"], "versions": [{"version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "lessThan": "1c57d1a3396b2d767d58f10dff09bb397586c714", "status": "affected", "versionType": "git"}, {"version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "lessThan": "9c4f9628b8558c87903492a777834cc5be14ded3", "status": "affected", "versionType": "git"}, {"version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "lessThan": "b7a0de398ad510426db9c8e96c516ef7abf48b0e", "status": "affected", "versionType": "git"}, {"version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "lessThan": "1c9fdd9465211432d5c0ff70caaec0be245823d5", "status": "affected", "versionType": "git"}, {"version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "lessThan": "29fe4d38fb59ec28ca656cb2dabc2b0f78e78980", "status": "affected", "versionType": "git"}, {"version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "lessThan": "0745a59945d927652d892437f9647ed6e87c0677", "status": "affected", "versionType": "git"}, {"version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "lessThan": "e6f1a1ac9b8ccabfec548aef0d0d93eaf4dba4f4", "status": "affected", "versionType": "git"}, {"version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "lessThan": "1bd456afeb8a515137e567967069fce6f8fcd23e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/usb/go7007/snd-go7007.c"], "versions": [{"version": "3.10", "status": "affected"}, {"version": "0", "lessThan": "3.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.270", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.10.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "7.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1c57d1a3396b2d767d58f10dff09bb397586c714"}, {"url": "https://git.kernel.org/stable/c/9c4f9628b8558c87903492a777834cc5be14ded3"}, {"url": "https://git.kernel.org/stable/c/b7a0de398ad510426db9c8e96c516ef7abf48b0e"}, {"url": "https://git.kernel.org/stable/c/1c9fdd9465211432d5c0ff70caaec0be245823d5"}, {"url": "https://git.kernel.org/stable/c/29fe4d38fb59ec28ca656cb2dabc2b0f78e78980"}, {"url": "https://git.kernel.org/stable/c/0745a59945d927652d892437f9647ed6e87c0677"}, {"url": "https://git.kernel.org/stable/c/e6f1a1ac9b8ccabfec548aef0d0d93eaf4dba4f4"}, {"url": "https://git.kernel.org/stable/c/1bd456afeb8a515137e567967069fce6f8fcd23e"}], "title": "media: go7007: defer the ALSA v4l2 put until card release", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/usb/go7007/snd-go7007.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1c57d1a3396b2d767d58f10dff09bb397586c714", "status": "affected", "version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "versionType": "git"}, {"lessThan": "9c4f9628b8558c87903492a777834cc5be14ded3", "status": "affected", "version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "versionType": "git"}, {"lessThan": "b7a0de398ad510426db9c8e96c516ef7abf48b0e", "status": "affected", "version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "versionType": "git"}, {"lessThan": "1c9fdd9465211432d5c0ff70caaec0be245823d5", "status": "affected", "version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "versionType": "git"}, {"lessThan": "29fe4d38fb59ec28ca656cb2dabc2b0f78e78980", "status": "affected", "version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "versionType": "git"}, {"lessThan": "0745a59945d927652d892437f9647ed6e87c0677", "status": "affected", "version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "versionType": "git"}, {"lessThan": "e6f1a1ac9b8ccabfec548aef0d0d93eaf4dba4f4", "status": "affected", "version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "versionType": "git"}, {"lessThan": "1bd456afeb8a515137e567967069fce6f8fcd23e", "status": "affected", "version": "d5d3a7cc127d096c22ad63c4ff72970e1beb22ef", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/usb/go7007/snd-go7007.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.10"}, {"lessThan": "3.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.270", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: go7007: defer the ALSA v4l2 put until card release\n\ngo7007_snd_init() already takes a v4l2_device reference for the ALSA\nside, but go7007_snd_remove() drops it immediately after calling\nsnd_card_free_when_closed().\n\nThat is too early when a userspace process still has the capture PCM open.\nThe ALSA card and its PCM callbacks remain alive until the last file is\nclosed, so the release path can still reach struct go7007 through\npcm->private_data and call go7007_snd_hw_free() after the V4L2 release path\nhas freed the object.\n\nMove the matching v4l2_device_put() to the ALSA card private_free callback\nso the existing ALSA reference covers the whole deferred card lifetime."}], "id": "CVE-2026-89890", "lastModified": "2026-09-16T15:18:15.500", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-16T11:16:57.610", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0745a59945d927652d892437f9647ed6e87c0677"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1bd456afeb8a515137e567967069fce6f8fcd23e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1c57d1a3396b2d767d58f10dff09bb397586c714"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1c9fdd9465211432d5c0ff70caaec0be245823d5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/29fe4d38fb59ec28ca656cb2dabc2b0f78e78980"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9c4f9628b8558c87903492a777834cc5be14ded3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b7a0de398ad510426db9c8e96c516ef7abf48b0e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e6f1a1ac9b8ccabfec548aef0d0d93eaf4dba4f4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}