CyberSecBulletin
CVE-2026-46090NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-46090 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 83bd62fa9620ac98d5d694bde14c50f98c8e7189, 345c24b2bcf0923dfae1ab41497351c68214ff76, 3727a3541788412c393eec236ad228d72efe19c7 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.1% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 83bd62fa9620ac98d5d694bde14c50f98c8e7189 or 345c24b2bcf0923dfae1ab41497351c68214ff76 or 3727a3541788412c393eec236ad228d72efe19c7 or d258cdce50ff3e02392917258e81a0ce9555c327, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.259 or 5.15.210 or 6.12.88 or 6.18.27, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux597603d615d2b19a9e451d8cfac24372856a522d up to, but not including, 83bd62fa9620ac98d5d694bde14c50f98c8e7189; 597603d615d2b19a9e451d8cfac24372856a522d up to, but not including, 345c24b2bcf0923dfae1ab41497351c68214ff76; 597603d615d2b19a9e451d8cfac24372856a522d up to, but not including, 3727a3541788412c393eec236ad228d72efe19c7; 597603d615d2b19a9e451d8cfac24372856a522d up to, but not including, d258cdce50ff3e02392917258e81a0ce9555c327; 597603d615d2b19a9e451d8cfac24372856a522d up to, but not including, 03f52a9c170431e8f10e156b9dc0dae80b3e9198; 597603d615d2b19a9e451d8cfac24372856a522d up to, but not including, bdd9503c3d222d2735b56c7a8b4422ccf3de6e5c; 597603d615d2b19a9e451d8cfac24372856a522d up to, but not including, 5d45e34bf001344e2966dabca1897561bbc9e913; 597603d615d2b19a9e451d8cfac24372856a522d up to, but not including, e5c33cdc6f402eab8abd36ecf436b22c9d3a8aff; and 1 more ranges83bd62fa9620ac98d5d694bde14c50f98c8e7189, 345c24b2bcf0923dfae1ab41497351c68214ff76, 3727a3541788412c393eec236ad228d72efe19c7, d258cdce50ff3e02392917258e81a0ce9555c327, 03f52a9c170431e8f10e156b9dc0dae80b3e9198, bdd9503c3d222d2735b56c7a8b4422ccf3de6e5c
Red HatRed Hat Enterprise Linux 10Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 10.0 Extended Update SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-OnNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update ServiceNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP SolutionsNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP SolutionsNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP SolutionsNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9.6 Extended Update SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 6Not specified in the recordNot stated
LinuxLinux Kernel2.6.37 up to, but not including, 5.10.259; 5.11 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.12.88; 6.13 up to, but not including, 6.18.27; 6.19 up to, but not including, 7.0.4; 7.15.10.259, 5.15.210, 6.12.88, 6.18.27, 7.0.4

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighCNA
CVSS 3.17.0HighCNA

Official description

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture stream. Commit 826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved the peer lookup under cable->lock, but the actual snd_pcm_stop() still runs after dropping that lock. A concurrent close can clear the capture entry from cable->streams[] and detach or free its runtime while the playback trigger path still holds a stale peer substream pointer. Keep a per-cable count of in-flight peer stops before dropping cable->lock, and make free_cable() wait for those stops before detaching the runtime. This preserves the existing behavior while making the peer runtime lifetime explicit.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.