CyberSecBulletin
CVE-2026-46004NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-46004 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions da938aa9fc7826901921dcea225948ab21a97e45, 09616e25f502080ba684fc7fcf959d1376ab756d, b956e48371f2ff72b76be9a829800ecec963bd45 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to da938aa9fc7826901921dcea225948ab21a97e45 or 09616e25f502080ba684fc7fcf959d1376ab756d or b956e48371f2ff72b76be9a829800ecec963bd45 or f537e3ad69609f6924a4db6b4a7f6561f5288bdd, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.258 or 5.15.209 or 6.1.175 or 6.6.140, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux8e3cd08ed8e590952aa9a656758cb24d4ba898f8 up to, but not including, da938aa9fc7826901921dcea225948ab21a97e45; 8e3cd08ed8e590952aa9a656758cb24d4ba898f8 up to, but not including, 09616e25f502080ba684fc7fcf959d1376ab756d; 8e3cd08ed8e590952aa9a656758cb24d4ba898f8 up to, but not including, b956e48371f2ff72b76be9a829800ecec963bd45; 8e3cd08ed8e590952aa9a656758cb24d4ba898f8 up to, but not including, f537e3ad69609f6924a4db6b4a7f6561f5288bdd; 8e3cd08ed8e590952aa9a656758cb24d4ba898f8 up to, but not including, 6251e3e256337a30160ef59ab1580dde4d1acd28; 8e3cd08ed8e590952aa9a656758cb24d4ba898f8 up to, but not including, e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056; 8e3cd08ed8e590952aa9a656758cb24d4ba898f8 up to, but not including, 096dd8519cf2f768e9e14f224b627f7aaee1a9c5; 8e3cd08ed8e590952aa9a656758cb24d4ba898f8 up to, but not including, 28abd224db4a49560b452115bca3672a20e45b2f; and 1 more rangesda938aa9fc7826901921dcea225948ab21a97e45, 09616e25f502080ba684fc7fcf959d1376ab756d, b956e48371f2ff72b76be9a829800ecec963bd45, f537e3ad69609f6924a4db6b4a7f6561f5288bdd, 6251e3e256337a30160ef59ab1580dde4d1acd28, e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056
LinuxLinux Kernel2.6.25 up to, but not including, 5.10.258; 5.11 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.140; 6.7 up to, but not including, 6.12.86; 6.13 up to, but not including, 6.18.27; 6.19 up to, but not including, 7.0.45.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.86, 6.18.27

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Handle probe errors properly The probe procedure of setup_card() in caiaq driver doesn't treat the error cases gracefully, e.g. the error from snd_card_register() calls snd_card_free() but continues. This would lead to a UAF for the further calls like snd_usb_caiaq_control_init(), as Berk suggested in another patch in the link below. However, the problem is not only that; in general, this function drops the all error handlings (as it's a void function) although its caller can propagate an error to snd_probe(), which eventually calls snd_card_free() as a proper error path. That said, we should treat each error case in setup_card(), and just return the error code promptly, which is then handled later as a fatal error in snd_probe(). This patch achieves it by changing the setup_card() to return an error code. Also, the superfluous snd_card_free() call is removed, too. Note that card->private_free can be set still safely at returning an error. All called functions in card_free() have checks of the unassigned resources or NULL checks.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.