CVE-2026-46090: ALSA: aloop: Fix peer runtime UAF during format-change stop

Synopsis

This is a use-after-free (UAF) vulnerability in the Linux kernel's ALSA loopback audio driver (aloop). An attacker with a local shell account on the host can trigger the bug by racing a format-change stop against a concurrent stream close, causing the playback trigger path to dereference a freed peer substream pointer. Successful exploitation gives the attacker read, write, and execute capabilities over kernel memory, enabling privilege escalation or full system compromise. A patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the race condition in the ALSA aloop driver.

• Victim interactionNot required

  No user interaction is needed; the attacker triggers the vulnerability entirely through their own process actions.

• Attack complexityDetail

  Exploit complexity is low; no special memory layout, race-window tuning, or environmental pre-conditions beyond a local account are required for reliable exploitation.

Blast Radius

• Reads arbitrary kernel memory, exposing credentials, session tokens, and other sensitive in-memory data belonging to any process on the host.
• Writes to arbitrary kernel memory, allowing the attacker to overwrite security-critical structures and escalate privileges to root.
• Crashes the affected kernel or renders the system unresponsive by corrupting freed memory structures in the audio subsystem.
• With kernel-level code execution achieved, the attacker can escape container boundaries and affect co-tenant workloads on the same host.