{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43126", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.988Z", "datePublished": "2026-05-06T11:27:15.765Z", "dateUpdated": "2026-08-05T12:26:07.097Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:26:07.097Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: mixer: oss: Add card disconnect checkpoints\n\nALSA OSS mixer layer calls the kcontrol ops rather individually, and\npending calls might be not always caught at disconnecting the device.\n\nFor avoiding the potential UAF scenarios, add sanity checks of the\ncard disconnection at each entry point of OSS mixer accesses. The\nrwsem is taken just before that check, hence the rest context should\nbe covered by that properly." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable OSS mixer kcontrol paths are reached through local ioctl operations on `/dev/mixer*` or forwarded OSS PCM mixer ioctls. The disconnect side can be induced in a reasonable hotpluggable sound-device scenario while the attacker drives repeated local ioctls.\nAC:L - This is a race, but a local attacker can repeatedly issue mixer ioctls and, in hotplug deployments, control or repeatedly induce the disconnect event. There is no rare memory layout or victim state prerequisite needed to trigger the vulnerable path.\nPR:L - The attacker needs local access to an ALSA OSS mixer or PCM device node, but no kernel capability or real root privilege is checked in the ioctl path. This is basic unprivileged local access where device permissions grant audio-device use.\nUI:N - No victim interaction is required once the attacker can run the local ioctl workload and induce the disconnect condition. The attacker controls the operations needed for exploitation.\nS:U - The vulnerability is in kernel sound-card handling and impacts the same kernel security authority. It is a standard local kernel compromise or crash scenario, not a VM, IOMMU, or other scope-crossing boundary.\nC:H - The fix explicitly addresses potential use-after-free scenarios when OSS mixer code invokes kcontrol callbacks after card shutdown. Per kernel UAF scoring guidance, this can be leveraged for high-impact information disclosure.\nI:H - The stale kcontrol callback path can operate on freed or disconnected driver state, making this a use-after-free class memory corruption issue. UAF exploitation can provide write/control-flow primitives, so integrity impact is high.\nA:H - Even without full exploitation, invoking kcontrol callbacks after disconnect can dereference freed or invalid device state and crash the kernel. A kernel oops or panic is high availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/core/oss/mixer_oss.c" ], "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "ae583f113d15fa97e5234133c20d09f8e6214e47", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "e6645e625480cdf1079a4265f758d13b70721029", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "8c097cf736993454acf3f711a3b376d6c7ad8965", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "084d5d44418148662365eced3e126ad1a81ee3e2", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/core/oss/mixer_oss.c" ], "versions": [ { "version": "2.6.12", "status": "affected" }, { "version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.12.75" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.18.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.19.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ae583f113d15fa97e5234133c20d09f8e6214e47" }, { "url": "https://git.kernel.org/stable/c/e6645e625480cdf1079a4265f758d13b70721029" }, { "url": "https://git.kernel.org/stable/c/8c097cf736993454acf3f711a3b376d6c7ad8965" }, { "url": "https://git.kernel.org/stable/c/084d5d44418148662365eced3e126ad1a81ee3e2" } ], "title": "ALSA: mixer: oss: Add card disconnect checkpoints", "x_generator": { "engine": "bippy-1.2.0" } } } }