CVE-2026-98264: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: reset device before deleting virtqueues virtsndremove and virtsndfreeze delete the virtqueues before resetting the device. delvqs frees the vring backing, but does not provide a generic device quiesce operation. In...

CVE-2026-98266: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix potential UAF after asynchronous card release Usually a sound driver releases the resources assigned to the card via sndcardfree, and it synchronizes with the whole release procedure. However, when the card is...

CVE-2026-98308: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by...

CVE-2026-98314: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer-privatedata before registering the PCM timer sndpcmtimerinit calls snddeviceregister to link the new struct sndtimer into the global timer list while it still carries hw.cresolution = sndpcmtimerresolution an...

Linux Distros Unpatched Vulnerability : CVE-2026-98314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: pcm: set timer-privatedata before registering the PCM timer sndpcmtimerinit calls snddeviceregister to link the new struct sndtimer into the global timer...

Linux Distros Unpatched Vulnerability : CVE-2026-98266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: core: Fix potential UAF after asynchronous card release Usually a sound driver releases the resources assigned to the card via sndcardfree, and it...

Linux Distros Unpatched Vulnerability : CVE-2026-98312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-98316

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: bcd2000: Fix race between rawmidi and disconnect Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an...

Linux Distros Unpatched Vulnerability : CVE-2026-98308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check...

PT-2026-106595

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ALSA core. When a sound driver, such as the USB-audio driver, releases a card asynchronously using the snd card free when closed function, in-flight...

PT-2026-106593

In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: reset device before deleting virtqueues virtsnd remove and virtsnd freeze delete the virtqueues before resetting the device. del vqs frees the vring backing, but does not provide a generic device quiesce operation. ...

PT-2026-106643

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer-private data before registering the PCM timer snd pcm timer init calls snd device register to link the new struct snd timer into the global timer list while it still carries hw.c resolution = snd pcm timer...

PT-2026-106637

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by...

Linux Distros Unpatched Vulnerability : CVE-2026-98264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: virtio: reset device before deleting virtqueues virtsndremove and virtsndfreeze delete the virtqueues before resetting the device. delvqs frees the vring...

Linux Distros Unpatched Vulnerability : CVE-2026-98265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity dataepsetparams allocates each data URB for exactly u-packets isochronous frames, so...

PT-2026-106594

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity data ep set params allocates each data URB for exactly u-packets isochronous frames, so urb-iso frame desc has u-packets slots and ctx-packets is the driver's...

CVE-2026-98092

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA AMD audio driver. This vulnerability can lead to a Denial of Service DoS due to a memory leak when closing audio capture streams. A local user could exploit this flaw by repeatedly opening and closing the affected audio...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97 – fixed a double-free in sndac97controllerregister. If ac97addadapter fails, putdevice is the correct way to release the device reference. kfree is not required. Add kfree if idralloc fails, and also in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Limiting PTP to a single page The commit 391e69143d0a increased CTPTPNUM from 1 to 4 to support 256 playback streams. However, the additional pages are not utilized correctly by the hardware. The CT20K2 hardware...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: In the seq function, there is a issue where closing a timer that was re-opened within the destructor may cause issues. The queuedelete function closes the timer and frees it. The sndseqtimerclose function clears...