Look up another CVE · open CVE-2026-89890 in the interactive tracker
CVE-2026-89890
media: go7007: defer the ALSA v4l2 put until card release
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem drivers/media. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-89890 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
go7007_snd_init() already takes a v4l2_device reference for the ALSA side, but go7007_snd_remove() drops it immediately after calling snd_card_free_when_closed(). That is too early when a userspace process still has the capture PCM open. The ALSA card and its PCM callbacks remain alive until the last file is closed, so the release path can still reach struct go7007 through pcm->private_data and call go7007_snd_hw_free() after the V4L2 release path has freed the object. Move the matching v4l2_device_put() to the ALSA card private_free callback so the existing ALSA reference covers the whole deferred card lifetime.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/media/usb/go7007/snd-go7007.c
- What this is
- GO7007 MPEG CODECMAINTAINERS section matched on drivers/media/usb/go7007/ · linux-media@vger.kernel.org · Maintained
- Kernel module
- go7007
Check it on the machine
grep -w CONFIG_VIDEO_GO7007 /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w go7007Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, i386/686, i386/686-pae, i386/rt/686-pae
- trixieMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64
- forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64
- bookworm · linux-6.12Mnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_VIDEO_GO7007
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.16%, higher than 5.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/media
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.10 | 5.10.270 | 1c57d1a3396b |
| 3.10 | 5.15.221 | 9c4f9628b855 |
| 3.10 | 6.1.188 | b7a0de398ad5 |
| 3.10 | 6.6.157 | 1c9fdd946521 |
| 3.10 | 6.12.110 | 29fe4d38fb59 |
| 3.10 | 6.18.51 | 0745a59945d9 |
| 3.10 | 7.2.5 | e6f1a1ac9b8c |
| 3.10 | 7.3 | 1bd456afeb8a |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The UAF is reached locally by holding the go7007 ALSA capture PCM open, forcing go7007_usb_disconnect() via USBDEVFS_DISCONNECT or sysfs unbind, then closing the PCM; there is no network path. Physical unplug is only an extra path, matching USB disconnect UAF scores (CVE-2026-80971, CVE-2025-40283).
- AC:LAttack complexity, low
- The attacker fully controls the sequence: open the capture PCM, disconnect the already-bound device, then close. go7007_snd_remove() drops the ALSA v4l2 ref before snd_card_free_when_closed() finishes, so close deterministically hits hw_free/capture_close on the freed go7007 with no attacker-uncontrollable race.
- PR:LPrivileges required, low
- Opening /dev/snd/pcmC*D*c has no capability check (audio group or seat/udev ACL), and USBDEVFS_DISCONNECT has no capable() gate, only write access to /dev/bus/usb that plugdev/uaccess grants seat users. Init-namespace root is not required.
- UI:NUser interaction, none
- The attacker performs PCM open, disconnect, and close on their own fds against an already-attached go7007 capture device (kiosk, industrial encoder, or shared workstation). No separate victim action such as plugging a cable or mounting a filesystem is required.
- S:UScope, unchanged
- The slab use-after-free of struct go7007 and the later ALSA PCM/card teardown run entirely in the host kernel. This is ordinary local privilege escalation, not a VM, IOMMU, or sandbox boundary escape.
- C:HConfidentiality impact, high
- Per kernel UAF guidance confidentiality is High. After kfree(go), PCM close reads the dangling object (snd_pcm_substream_chip → go->snd_context and related fields); reclaiming that slab lets the attacker supply pointer-rich state and obtain a kernel disclosure primitive.
- I:HIntegrity impact, high
- go7007_snd_hw_free() writes audio_deliver on the freed go7007, capture_close() writes through go->snd_context, and go7007_snd_free() kfree()s that pointer. A reclaimed object yields write-after-free and arbitrary-free primitives suitable for control-flow hijack.
- A:HAvailability impact, high
- Dereferencing the freed go7007 in PCM close/hw_free, and kfree of snd_context during deferred card free, reliably oopses or panics the kernel. The attacker can repeat disconnect/close to crash on demand, so availability impact is High.