CVE-2026-31581

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31581", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.119Z", "datePublished": "2026-04-24T14:42:11.557Z", "dateUpdated": "2026-06-14T17:42:07.970Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-14T17:42:07.970Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: fix use-after-free on disconnect\n\nIn usb6fire_chip_abort(), the chip struct is allocated as the card's\nprivate data (via snd_card_new with sizeof(struct sfire_chip)). When\nsnd_card_free_when_closed() is called and no file handles are open, the\ncard and embedded chip are freed synchronously. The subsequent\nchip->card = NULL write then hits freed slab memory.\n\nCall trace:\n usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline]\n usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182\n usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458\n ...\n hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953\n\nFix by moving the card lifecycle out of usb6fire_chip_abort() and into\nusb6fire_chip_disconnect(). The card pointer is saved in a local\nbefore any teardown, snd_card_disconnect() is called first to prevent\nnew opens, URBs are aborted while chip is still valid, and\nsnd_card_free_when_closed() is called last so chip is never accessed\nafter the card may be freed."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/6fire/chip.c"], "versions": [{"version": "f2d06d4e129e2508e356136f99bb20a332ff1a00", "lessThan": "e719232f4552e29de8027a83918ea94434be87af", "status": "affected", "versionType": "git"}, {"version": "b889a7d68d7e76b8795b754a75c91a2d561d5e8c", "lessThan": "e247a0e01d15ed420f77ec5e2335721bf430a5b3", "status": "affected", "versionType": "git"}, {"version": "ea8cc56db659cf0ae57073e32a4735ead7bd7ee3", "lessThan": "ba88461f7653636c48321ca993006a74724c2f41", "status": "affected", "versionType": "git"}, {"version": "b754e831a94f82f2593af806741392903f359168", "lessThan": "e88354b381e2006de63d6b052ed7005c9a47d00e", "status": "affected", "versionType": "git"}, {"version": "57860a80f03f9dc69a34a5c37b0941ad032a0a8c", "lessThan": "af75b486f7e883e3422ece23c8d727e6815144a0", "status": "affected", "versionType": "git"}, {"version": "a0810c3d6dd2d29a9b92604d682eacd2902ce947", "lessThan": "d21e8a2af4869b5890b34e081d5aeadc93e9cd5c", "status": "affected", "versionType": "git"}, {"version": "a0810c3d6dd2d29a9b92604d682eacd2902ce947", "lessThan": "3dc20d1981d6a67d8184498a5da272942dde1e65", "status": "affected", "versionType": "git"}, {"version": "a0810c3d6dd2d29a9b92604d682eacd2902ce947", "lessThan": "51f6532790b74ffdd6970bc848358a2838c1c185", "status": "affected", "versionType": "git"}, {"version": "a0810c3d6dd2d29a9b92604d682eacd2902ce947", "lessThan": "b9c826916fdce6419b94eb0cd8810fdac18c2386", "status": "affected", "versionType": "git"}, {"version": "74357d0b5cd3ef544752bc9f21cbeee4902fae6c", "status": "affected", "versionType": "git"}, {"version": "273eec23467dfbfbd0e4c10302579ba441fb1e13", "status": "affected", "versionType": "git"}, {"version": "0df7f4b5cc10f5adf98be0845372e9eef7bb5b09", "status": "affected", "versionType": "git"}, {"version": "5.10.231", "lessThan": "5.10.258", "status": "affected", "versionType": "semver"}, {"version": "5.15.174", "lessThan": "5.15.209", "status": "affected", "versionType": "semver"}, {"version": "6.1.120", "lessThan": "6.1.175", "status": "affected", "versionType": "semver"}, {"version": "6.6.64", "lessThan": "6.6.136", "status": "affected", "versionType": "semver"}, {"version": "6.12.2", "lessThan": "6.12.83", "status": "affected", "versionType": "semver"}, {"version": "4.19.325", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.287", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "6.11.11", "lessThan": "6.12", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/6fire/chip.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.1", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.231", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.174", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.120", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.64", "versionEndExcluding": "6.6.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.2", "versionEndExcluding": "6.12.83"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.19.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.325"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.287"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e719232f4552e29de8027a83918ea94434be87af"}, {"url": "https://git.kernel.org/stable/c/e247a0e01d15ed420f77ec5e2335721bf430a5b3"}, {"url": "https://git.kernel.org/stable/c/ba88461f7653636c48321ca993006a74724c2f41"}, {"url": "https://git.kernel.org/stable/c/e88354b381e2006de63d6b052ed7005c9a47d00e"}, {"url": "https://git.kernel.org/stable/c/af75b486f7e883e3422ece23c8d727e6815144a0"}, {"url": "https://git.kernel.org/stable/c/d21e8a2af4869b5890b34e081d5aeadc93e9cd5c"}, {"url": "https://git.kernel.org/stable/c/3dc20d1981d6a67d8184498a5da272942dde1e65"}, {"url": "https://git.kernel.org/stable/c/51f6532790b74ffdd6970bc848358a2838c1c185"}, {"url": "https://git.kernel.org/stable/c/b9c826916fdce6419b94eb0cd8810fdac18c2386"}], "title": "ALSA: 6fire: fix use-after-free on disconnect", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/6fire/chip.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e719232f4552e29de8027a83918ea94434be87af", "status": "affected", "version": "f2d06d4e129e2508e356136f99bb20a332ff1a00", "versionType": "git"}, {"lessThan": "e247a0e01d15ed420f77ec5e2335721bf430a5b3", "status": "affected", "version": "b889a7d68d7e76b8795b754a75c91a2d561d5e8c", "versionType": "git"}, {"lessThan": "ba88461f7653636c48321ca993006a74724c2f41", "status": "affected", "version": "ea8cc56db659cf0ae57073e32a4735ead7bd7ee3", "versionType": "git"}, {"lessThan": "e88354b381e2006de63d6b052ed7005c9a47d00e", "status": "affected", "version": "b754e831a94f82f2593af806741392903f359168", "versionType": "git"}, {"lessThan": "af75b486f7e883e3422ece23c8d727e6815144a0", "status": "affected", "version": "57860a80f03f9dc69a34a5c37b0941ad032a0a8c", "versionType": "git"}, {"lessThan": "d21e8a2af4869b5890b34e081d5aeadc93e9cd5c", "status": "affected", "version": "a0810c3d6dd2d29a9b92604d682eacd2902ce947", "versionType": "git"}, {"lessThan": "3dc20d1981d6a67d8184498a5da272942dde1e65", "status": "affected", "version": "a0810c3d6dd2d29a9b92604d682eacd2902ce947", "versionType": "git"}, {"lessThan": "51f6532790b74ffdd6970bc848358a2838c1c185", "status": "affected", "version": "a0810c3d6dd2d29a9b92604d682eacd2902ce947", "versionType": "git"}, {"lessThan": "b9c826916fdce6419b94eb0cd8810fdac18c2386", "status": "affected", "version": "a0810c3d6dd2d29a9b92604d682eacd2902ce947", "versionType": "git"}, {"status": "affected", "version": "74357d0b5cd3ef544752bc9f21cbeee4902fae6c", "versionType": "git"}, {"status": "affected", "version": "273eec23467dfbfbd0e4c10302579ba441fb1e13", "versionType": "git"}, {"status": "affected", "version": "0df7f4b5cc10f5adf98be0845372e9eef7bb5b09", "versionType": "git"}, {"lessThan": "5.10.258", "status": "affected", "version": "5.10.231", "versionType": "semver"}, {"lessThan": "5.15.209", "status": "affected", "version": "5.15.174", "versionType": "semver"}, {"lessThan": "6.1.175", "status": "affected", "version": "6.1.120", "versionType": "semver"}, {"lessThan": "6.6.136", "status": "affected", "version": "6.6.64", "versionType": "semver"}, {"lessThan": "6.12.83", "status": "affected", "version": "6.12.2", "versionType": "semver"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.325", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.287", "versionType": "semver"}, {"lessThan": "6.12", "status": "affected", "version": "6.11.11", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/usb/6fire/chip.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.136", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.83", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.24", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.14", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "14109CEF-714B-4029-A318-97AA58A01833", "versionEndExcluding": "6.6.136", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A8BAD957-8E20-401C-A129-DFF3655CA0B7", "versionEndExcluding": "6.12.83", "versionStartIncluding": "6.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A", "versionEndExcluding": "7.0.1", "versionStartIncluding": "7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: fix use-after-free on disconnect\n\nIn usb6fire_chip_abort(), the chip struct is allocated as the card's\nprivate data (via snd_card_new with sizeof(struct sfire_chip)). When\nsnd_card_free_when_closed() is called and no file handles are open, the\ncard and embedded chip are freed synchronously. The subsequent\nchip->card = NULL write then hits freed slab memory.\n\nCall trace:\n usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline]\n usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182\n usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458\n ...\n hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953\n\nFix by moving the card lifecycle out of usb6fire_chip_abort() and into\nusb6fire_chip_disconnect(). The card pointer is saved in a local\nbefore any teardown, snd_card_disconnect() is called first to prevent\nnew opens, URBs are aborted while chip is still valid, and\nsnd_card_free_when_closed() is called last so chip is never accessed\nafter the card may be freed."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: 6fire: corregir uso despu\u00e9s de liberaci\u00f3n al desconectar\n\nEn usb6fire_chip_abort(), la estructura chip se asigna como datos privados de la tarjeta (a trav\u00e9s de snd_card_new con sizeof(struct sfire_chip)). Cuando se llama a snd_card_free_when_closed() y no hay descriptores de archivo abiertos, la tarjeta y el chip incrustado se liberan sincr\u00f3nicamente. La escritura posterior de chip -> card = NULL entonces accede a memoria slab liberada.\n\nTraza de llamada:\n usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline]\n usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182\n usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458\n ...\n hub_event+0x 1a04/0x 4518 drivers/usb/core/hub.c:5953\n\nSoluci\u00f3n moviendo el ciclo de vida de la tarjeta fuera de usb6fire_chip_abort() y hacia usb6fire_chip_disconnect(). El puntero de la tarjeta se guarda en una variable local antes de cualquier desmantelamiento, se llama primero a snd_card_disconnect() para evitar nuevas aperturas, los URB se abortan mientras el chip sigue siendo v\u00e1lido, y se llama a snd_card_free_when_closed() al final para que el chip nunca sea accedido despu\u00e9s de que la tarjeta pueda ser liberada."}], "id": "CVE-2026-31581", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-24T15:16:32.797", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3dc20d1981d6a67d8184498a5da272942dde1e65"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/51f6532790b74ffdd6970bc848358a2838c1c185"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/af75b486f7e883e3422ece23c8d727e6815144a0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b9c826916fdce6419b94eb0cd8810fdac18c2386"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba88461f7653636c48321ca993006a74724c2f41"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d21e8a2af4869b5890b34e081d5aeadc93e9cd5c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e247a0e01d15ed420f77ec5e2335721bf430a5b3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e719232f4552e29de8027a83918ea94434be87af"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e88354b381e2006de63d6b052ed7005c9a47d00e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ALSA: 6fire: fix use-after-free on disconnect", "id": "2461471", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461471"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's ALSA 6fire USB audio device driver. During the disconnection process of a 6fire USB audio device, a use-after-free vulnerability occurs. This happens when the system attempts to write to memory that has already been deallocated, which can lead to memory corruption and potentially cause system instability or a denial of service."], "name": "CVE-2026-31581", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31581\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31581\nhttps://lore.kernel.org/linux-cve-announce/2026042411-CVE-2026-31581-9bc2@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b754e831a94f82f2593af806741392903f359168,e88354b381e2006de63d6b052ed7005c9a47d00e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[57860a80f03f9dc69a34a5c37b0941ad032a0a8c,af75b486f7e883e3422ece23c8d727e6815144a0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a0810c3d6dd2d29a9b92604d682eacd2902ce947,d21e8a2af4869b5890b34e081d5aeadc93e9cd5c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a0810c3d6dd2d29a9b92604d682eacd2902ce947,3dc20d1981d6a67d8184498a5da272942dde1e65)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a0810c3d6dd2d29a9b92604d682eacd2902ce947,51f6532790b74ffdd6970bc848358a2838c1c185)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a0810c3d6dd2d29a9b92604d682eacd2902ce947,b9c826916fdce6419b94eb0cd8810fdac18c2386)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "74357d0b5cd3ef544752bc9f21cbeee4902fae6c"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "273eec23467dfbfbd0e4c10302579ba441fb1e13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "f2d06d4e129e2508e356136f99bb20a332ff1a00"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b889a7d68d7e76b8795b754a75c91a2d561d5e8c"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "ea8cc56db659cf0ae57073e32a4735ead7bd7ee3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "0df7f4b5cc10f5adf98be0845372e9eef7bb5b09"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.136,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.83,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.24,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.14,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0.1,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T14:06:40.056838+00:00", "value": {"mitigation_remediation": ["Update the kernel to a version that includes the patch fixing the use\u2011after\u2011free in the ALSA 6fire driver.", "Reboot the system after the kernel upgrade to ensure the new driver is loaded and the vulnerable code is no longer active.", "If an immediate kernel update is unavailable, blacklist or unload the 6fire module (e.g., add \"install 6fire /bin/true\" to /etc/modprobe.d/blacklist.conf) to prevent the driver from loading and eliminate the risk of the vulnerability being triggered."], "summary": {"action": "Apply Patch", "impact": "Use\u2011after\u2011free leading to kernel memory corruption and possible privilege escalation or denial of service"}, "threat_synthesis": {"affected_systems": "The flaw affects any Linux kernel installation that includes the ALSA 6fire USB audio driver prior to the commit that moves the card lifecycle out of usb6fire_chip_abort. No specific kernel version is listed, so all affected kernel releases that contain the unpatched driver are implicated.", "description_and_impact": "The vulnerability resides in the ALSA 6fire driver of the Linux kernel, where a use\u2011after\u2011free occurs during device disconnect. The bug allows the driver to write to freed memory after the ALSA card and its chip structure are released, which can corrupt kernel memory. An attacker could potentially exploit this to gain kernel\u2011level execution privileges or cause a system crash, affecting confidentiality, integrity, and availability.", "risk_and_exploitability": "The CVSS score of 7.8 rates the issue as high impact, while the EPSS score of less than 1\u202f% indicates a low likelihood of widespread exploitation at present. The vulnerability is not yet listed in CISA\u2019s KEV catalog. Exploitation would most likely require physical or local access to the USB audio device, or the ability to cause a disconnect event, making it a local or device\u2011based attack vector."}}}}, "created": "2026-04-27T19:00:15.708703+00:00", "updated": "2026-04-28T14:15:34.906870+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}