Vulnerability-Lookup

GHSA-3M8W-Q233-VHRP

Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-05-08 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

ALSA: mixer: oss: Add card disconnect checkpoints

ALSA OSS mixer layer calls the kcontrol ops rather individually, and pending calls might be not always caught at disconnecting the device.

For avoiding the potential UAF scenarios, add sanity checks of the card disconnection at each entry point of OSS mixer accesses. The rwsem is taken just before that check, hence the rest context should be covered by that properly.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-43126"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-06T12:16:29Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: mixer: oss: Add card disconnect checkpoints\n\nALSA OSS mixer layer calls the kcontrol ops rather individually, and\npending calls might be not always caught at disconnecting the device.\n\nFor avoiding the potential UAF scenarios, add sanity checks of the\ncard disconnection at each entry point of OSS mixer accesses.  The\nrwsem is taken just before that check, hence the rest context should\nbe covered by that properly.",
  "id": "GHSA-3m8w-q233-vhrp",
  "modified": "2026-05-08T15:31:16Z",
  "published": "2026-05-06T12:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43126"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/084d5d44418148662365eced3e126ad1a81ee3e2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8c097cf736993454acf3f711a3b376d6c7ad8965"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ae583f113d15fa97e5234133c20d09f8e6214e47"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e6645e625480cdf1079a4265f758d13b70721029"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-43126 (GCVE-0-2026-43126)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-08-05 12:26

Title

ALSA: mixer: oss: Add card disconnect checkpoints

Summary

In the Linux kernel, the following vulnerability has been resolved: ALSA: mixer: oss: Add card disconnect checkpoints ALSA OSS mixer layer calls the kcontrol ops rather individually, and pending calls might be not always caught at disconnecting the device. For avoiding the potential UAF scenarios, add sanity checks of the card disconnection at each entry point of OSS mixer accesses. The rwsem is taken just before that check, hence the rest context should be covered by that properly.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/ae583f113d15fa97e…
https://git.kernel.org/stable/c/e6645e625480cdf10…
https://git.kernel.org/stable/c/8c097cf736993454a…
https://git.kernel.org/stable/c/084d5d44418148662…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ae583f113d15fa97e5234133c20d09f8e6214e47 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e6645e625480cdf1079a4265f758d13b70721029 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8c097cf736993454acf3f711a3b376d6c7ad8965 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 084d5d44418148662365eced3e126ad1a81ee3e2 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/core/oss/mixer_oss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ae583f113d15fa97e5234133c20d09f8e6214e47",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e6645e625480cdf1079a4265f758d13b70721029",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "8c097cf736993454acf3f711a3b376d6c7ad8965",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "084d5d44418148662365eced3e126ad1a81ee3e2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/core/oss/mixer_oss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: mixer: oss: Add card disconnect checkpoints\n\nALSA OSS mixer layer calls the kcontrol ops rather individually, and\npending calls might be not always caught at disconnecting the device.\n\nFor avoiding the potential UAF scenarios, add sanity checks of the\ncard disconnection at each entry point of OSS mixer accesses.  The\nrwsem is taken just before that check, hence the rest context should\nbe covered by that properly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable OSS mixer kcontrol paths are reached through local ioctl operations on `/dev/mixer*` or forwarded OSS PCM mixer ioctls. The disconnect side can be induced in a reasonable hotpluggable sound-device scenario while the attacker drives repeated local ioctls.\nAC:L - This is a race, but a local attacker can repeatedly issue mixer ioctls and, in hotplug deployments, control or repeatedly induce the disconnect event. There is no rare memory layout or victim state prerequisite needed to trigger the vulnerable path.\nPR:L - The attacker needs local access to an ALSA OSS mixer or PCM device node, but no kernel capability or real root privilege is checked in the ioctl path. This is basic unprivileged local access where device permissions grant audio-device use.\nUI:N - No victim interaction is required once the attacker can run the local ioctl workload and induce the disconnect condition. The attacker controls the operations needed for exploitation.\nS:U - The vulnerability is in kernel sound-card handling and impacts the same kernel security authority. It is a standard local kernel compromise or crash scenario, not a VM, IOMMU, or other scope-crossing boundary.\nC:H - The fix explicitly addresses potential use-after-free scenarios when OSS mixer code invokes kcontrol callbacks after card shutdown. Per kernel UAF scoring guidance, this can be leveraged for high-impact information disclosure.\nI:H - The stale kcontrol callback path can operate on freed or disconnected driver state, making this a use-after-free class memory corruption issue. UAF exploitation can provide write/control-flow primitives, so integrity impact is high.\nA:H - Even without full exploitation, invoking kcontrol callbacks after disconnect can dereference freed or invalid device state and crash the kernel. A kernel oops or panic is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:07.097Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ae583f113d15fa97e5234133c20d09f8e6214e47"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6645e625480cdf1079a4265f758d13b70721029"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c097cf736993454acf3f711a3b376d6c7ad8965"
        },
        {
          "url": "https://git.kernel.org/stable/c/084d5d44418148662365eced3e126ad1a81ee3e2"
        }
      ],
      "title": "ALSA: mixer: oss: Add card disconnect checkpoints",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43126",
    "datePublished": "2026-05-06T11:27:15.765Z",
    "dateReserved": "2026-05-01T14:12:55.988Z",
    "dateUpdated": "2026-08-05T12:26:07.097Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.