CVE-2026-99271
Description
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Line 6 USB audio driver. When releasing audio capture buffers, the driver fails to clear an internal buffer pointer, leaving a stale reference to freed memory. A local user can exploit this issue by triggering audio playback after closing a capture stream, resulting in a use-after-free condition that may lead to a denial of service (system crash) or unauthorized memory disclosure.
Statement
This vulnerability is evaluated as having a Moderate impact because exploitation requires local access and the physical presence or attachment of specialized Line 6 USB audio hardware. An authenticated local attacker could leverage the dangling buffer pointer to crash the system and cause a denial of service, but remote exploitation is not possible. Standard Red Hat Enterprise Linux deployments rarely interface with these consumer audio devices, severely limiting the attack surface in production environments.
Mitigation
Prevent the snd-usb-line6 kernel module from being loaded.
1. Add configuration files to /etc/modprobe.d to disable module loading:
# echo "install snd-usb-line6 /bin/true" > /etc/modprobe.d/disable-snd-usb-line6.conf
# echo "blacklist snd-usb-line6" >> /etc/modprobe.d/disable-snd-usb-line6.conf
2. Unload the module if it is currently active:
# modprobe -r snd-usb-line6
Caveats:
Disabling this module prevents the system from interfacing with any connected Line 6 USB audio hardware.
Warning:
If the module is currently in use by running processes or sound daemons, unloading may not succeed immediately and a system restart will be required for the change to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
