CVE-2026-43126

CVE-2026-43126

High · published May 6, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ALSA: mixer: oss: Add card disconnect checkpoints

ALSA OSS mixer layer calls the kcontrol ops rather individually, and

pending calls might be not always caught at disconnecting the device.

For avoiding the potential UAF scenarios, add sanity checks of the

card disconnection at each entry point of OSS mixer accesses. The

rwsem is taken just before that check, hence the rest context should

be covered by that properly.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00175 · 6.7th percentile
Published
2026-05-06T16:16Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel≥ 2.6.12, < 6.12.756.12.75
linux/linux_kernel≥ 6.13, < 6.18.166.18.16
linux/linux_kernel≥ 6.19, < 6.19.66.19.6
References (5)
EPSS history
Timeline
  • 06 MAY 11:27Z
    ALSA: mixer: oss: Add card disconnect checkpoints
    cvelistv5