CVE-2026-31581
ALSA: 6fire: fix use-after-free on disconnect
Reported by linux · Published April 24, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_card_free_when_closed() is called and no file handles are open, the card and embedded chip are freed synchronously. The subsequent chip->card = NULL write then hits freed slab memory. Call trace: usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline] usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182 usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458 ... hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953 Fix by moving the card lifecycle out of usb6fire_chip_abort() and into usb6fire_chip_disconnect(). The card pointer is saved in a local before any teardown, snd_card_disconnect() is called first to prevent new opens, URBs are aborted while chip is still valid, and snd_card_free_when_closed() is called last so chip is never accessed after the card may be freed.
EPSS 0.13% · 2.4th percentile
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| kernel-abi-stablelists | errata.rockylinux.org | 5.14.0-687.15.1.el9, 4.18.0-553.132.1.el8 |
| kernel-tools-libs-devel | errata.rockylinux.org | 6.12.0-211.22.1.el10, 5.14.0-687.15.1.el9, 4.18.0-553.132.1.el8 |
| perf-debuginfo | errata.rockylinux.org | 5.14.0-687.15.1.el9 |
| kernel-modules | errata.rockylinux.org | 6.12.0-211.22.1.el10, 5.14.0-687.15.1.el9 |
| kernel-debug-devel | errata.rockylinux.org | 5.14.0-687.15.1.el9 |
| kernel-debug-modules | errata.rockylinux.org | 6.12.0-211.22.1.el10, 5.14.0-687.15.1.el9, 4.18.0-553.132.1.el8 |
| kernel-devel-matched | errata.rockylinux.org | 6.12.0-211.22.1.el10, 5.14.0-687.15.1.el9 |
| kernel-debuginfo-common-aarch64 | errata.rockylinux.org | 6.12.0-211.22.1.el10, 5.14.0-687.15.1.el9, 4.18.0-553.132.1.el8 |
| kernel-rt-debuginfo-common-x86_64 | errata.rockylinux.org | 4.18.0-553.132.1.rt7.473.el8 |
| rv | errata.rockylinux.org | 5.14.0-687.15.1.el9 |
| kernel | errata.rockylinux.org | 5.14.0-687.15.1.el9 |
| kernel-debug-debuginfo | errata.rockylinux.org | 5.14.0-687.15.1.el9, 4.18.0-553.132.1.el8 |
41 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | f2d06d4e129e2508e356136f99bb20a332ff1a00, b889a7d68d7e76b8795b754a75c91a2d561d5e8c, ea8cc56db659cf0ae57073e32a4735ead7bd7ee3 |
| Linux | Linux | 6.13, 0, 5.10.258 |
| chainguard | linux-azure-6.18 | 0 |
| Linux | Linux | 7.1, 7.0.1, * |
| chainguard | linux-aws-6.12 | 0 |
| chainguard | linux-vmware-6.12 | 0 |
| chainguard | linux-aws-6.18 | 0 |
| chainguard | linux-gcp-6.12 | 0 |
| chainguard | linux-qemu-6.18 | 0 |
| chainguard | linux-gcp-6.18 | 0 |
| linux | linux_kernel | 6.12.2, 6.13, 6.13 |
| chainguard | linux-vmware-6.18 | 0 |
| chainguard | linux-qemu-6.12 | 0 |
Timeline
- Apr 24, 2026 CVE Published
- Apr 24, 2026 Security Advisory (104 in total, the first dated here)
- May 18, 2026 EPSS Score (24 in total, the first dated here)
- Jun 11, 2026 Distribution Patch (103 in total, the first dated here)
- Jul 18, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-31581
vulnetix vdb fixes CVE-2026-31581Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-31581/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart