Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-90032— media: usbtv: keep device alive while ALSA card exists

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已解决以下漏洞： media: usbtv: 在 ALSA 声卡存在期间保持设备存活 ALSA PCM 回调函数将驱动程序的状态存储在 中。由于 使用了 ，打开的 PCM 文件的生命周期可能长于 USB 断开连接的过程。在断开连接路径中，系统可能会释放 V4L2 设备引用，并在 ALSA 释放子流之前就释放了 结构体。这导致后续的关闭操作在 中引用了已释放的内存。 修复方式： 为 ALSA 声卡保留一个 V4L2 设备引用，并在卡片的 回调中释放该引用。这样可以确保在 ALSA 关闭剩余文件

CVSS 7.8 · High EPSS 0.15% · P4

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 63ddf68de52efaac40a9287e44266ac30e71dd36< 97b5e8b22b98e287481a97a9a4cfebbb348738a5 affected
63ddf68de52efaac40a9287e44266ac30e71dd36< 503be26ff888cb3576e55d251895d290e8146f27 affected
63ddf68de52efaac40a9287e44266ac30e71dd36< be0f7745f883386e5263b4e475686a81dfa87175 affected
63ddf68de52efaac40a9287e44266ac30e71dd36< 67374e3a00814dcdd46e9feca61f69f7f2d81957 affected
63ddf68de52efaac40a9287e44266ac30e71dd36< 239d1683e08b2aee2a15ef35706e1ea9a76681d8 affected
63ddf68de52efaac40a9287e44266ac30e71dd36< 7690a86b193271322cd31ab77349a87aa10858e4 affected
63ddf68de52efaac40a9287e44266ac30e71dd36< 1618257cb0aba4ce342ae8c0228368c24161f5fb affected
63ddf68de52efaac40a9287e44266ac30e71dd36< fc530fe168bb2b745a93f553ad21fc25fd9cba3d affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90032

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
media: usbtv: keep device alive while ALSA card exists
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: media: usbtv: keep device alive while ALSA card exists The ALSA PCM callbacks store the driver state in pcm->private_data. An open PCM file can outlive USB disconnect because usbtv_audio_free() uses snd_card_free_when_closed(). The disconnect path can then drop the V4L2 device reference and free struct usbtv before ALSA releases the substream, so a later close dereferences freed memory in snd_usbtv_pcm_close(). Take a V4L2 device reference for the ALSA card and drop it from the card private_free callback. This keeps struct usbtv valid until ALSA has closed the remaining files and freed the card.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 63ddf68de52efaac40a9287e44266ac30e71dd36 ~ 97b5e8b22b98e287481a97a9a4cfebbb348738a5 -
Linux Linux 3.18 -

II. Public POCs for CVE-2026-90032

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90032

请登录查看更多情报信息。

Other References for CVE-2026-90032 (8)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969 9.8 CRITICAL nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89916 9.3 CRITICAL KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89915 9.3 CRITICAL KVM: arm64: Remove VM-wide VNCR mapping counter
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775 9.3 CRITICAL KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89918 9.3 CRITICAL KVM: arm64: Correctly handle end of VA space TLBI invalidation

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90032

No comments yet

Leave a comment