CVE-2026-90032

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The UAF is reached locally by opening the usbtv ALSA capture PCM, forcing usbtv_disconnect() via USBDEVFS_DISCONNECT or sysfs unbind on an already-bound USBTV007, then closing the PCM fd; there is no network or packet path. This matches AV:L scoring of analogous USB disconnect UAFs (CVE-2026-80971, CVE-2026-64585); physical unplug is only an extra path.

AC:LAttack complexity, low

The attacker fully controls the sequence: open /dev/snd/pcmC*D*c so PCM callbacks pin pcm->private_data, issue USBDEVFS_DISCONNECT so snd_card_free_when_closed() returns without waiting, then close. That close deterministically hits freed struct usbtv in snd_usbtv_pcm_close(); no attacker-uncontrollable race or layout is required.

PR:LPrivileges required, low

USBDEVFS_DISCONNECT has no capable() check, only write access to /dev/bus/usb that udev uaccess/plugdev rules grant seat users, and snd_pcm_open() has no capability gate on the capture PCM node (audio group/uaccess). An unprivileged local account suffices; init-namespace root is not required.

UI:NUser interaction, none

The attacker performs open, disconnect, and close on their own fds against an already-attached USBTV007 (capture kiosk, digitizer, or surveillance station). No separate victim action such as plugging a device or clicking is required during exploitation.

S:UScope, unchanged

The slab use-after-free of struct usbtv and the PCM close/trigger callbacks run entirely in the host kernel. This is ordinary local privilege escalation, not a VM, IOMMU, or sandbox boundary escape.

C:HConfidentiality impact, high

snd_usbtv_pcm_close() and snd_usbtv_card_trigger() read fields of the kfree()'d struct usbtv (snd_stream, snd_trigger, snd_bulk_urb). Reclaiming that slab lets the attacker supply pointer-rich state those paths then read, enabling kernel disclosure as with other heap UAFs.

I:HIntegrity impact, high

Close can atomic_set snd_stream and schedule_work() on the freed usbtv.snd_trigger work_struct, and snd_pcm_drop may call trigger STOP on the same freed object. A reclaimed fake usbtv plus workqueue execution is a control-flow hijack primitive, so integrity impact is High.

A:HAvailability impact, high

Use-after-free of struct usbtv in snd_usbtv_pcm_close() (and in usbtv_audio_urb_received if capture was running when USB core kills the URB after disconnect) oopses or panics the kernel. The attacker can repeat disconnect/close to crash on demand, so availability impact is High.