High 7.8Published Apr 24, 2026

CVE-2026-31581ALSA: 6fire: fix use-after-free on disconnect

Updated under an hour ago (Oct 28, 2026, 3:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_card_free_when_closed() is called and no file handles are open, the card and embedded chip are freed synchronously. The subsequent chip->card = NULL write then hits freed slab memory. Call trace: usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline] usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182 usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458 ... hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953 Fix by moving the card lifecycle out of usb6fire_chip_abort() and into usb6fire_chip_disconnect(). The card pointer is saved in a local before any teardown, snd_card_disconnect() is called first to prevent new opens, URBs are aborted while chip is still valid, and snd_card_free_when_closed() is called last so chip is never accessed after the card may be freed.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Jun 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f2d06d4e129e2508e356136f99bb20a332ff1a00 before e719232f4552e29de8027a83918ea94434be87af; from b889a7d68d7e76b8795b754a75c91a2d561d5e8c before e247a0e01d15ed420f77ec5e2335721bf430a5b3; from ea8cc56db659cf0ae57073e32a4735ead7bd7ee3 before ba88461f7653636c48321ca993006a74724c2f41; from b754e831a94f82f2593af806741392903f359168 before e88354b381e2006de63d6b052ed7005c9a47d00e; from 57860a80f03f9dc69a34a5c37b0941ad032a0a8c before af75b486f7e883e3422ece23c8d727e6815144a0; from a0810c3d6dd2d29a9b92604d682eacd2902ce947 before d21e8a2af4869b5890b34e081d5aeadc93e9cd5c; from a0810c3d6dd2d29a9b92604d682eacd2902ce947 before 3dc20d1981d6a67d8184498a5da272942dde1e65; from a0810c3d6dd2d29a9b92604d682eacd2902ce947 before 51f6532790b74ffdd6970bc848358a2838c1c185; and 12 more ranges	CNA record
linux linux_kernel linux:linux_kernel	before 6.6.136; from 6.12 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; from 7.0 before 7.0.1	NVD

References

References

https://git.kernel.org/stable/c/e719232f4552e29de8027a83918ea94434be87af
https://git.kernel.org/stable/c/e247a0e01d15ed420f77ec5e2335721bf430a5b3
https://git.kernel.org/stable/c/ba88461f7653636c48321ca993006a74724c2f41
https://git.kernel.org/stable/c/e88354b381e2006de63d6b052ed7005c9a47d00e	patch
https://git.kernel.org/stable/c/af75b486f7e883e3422ece23c8d727e6815144a0	patch
https://git.kernel.org/stable/c/d21e8a2af4869b5890b34e081d5aeadc93e9cd5c	patch
https://git.kernel.org/stable/c/3dc20d1981d6a67d8184498a5da272942dde1e65	patch
https://git.kernel.org/stable/c/51f6532790b74ffdd6970bc848358a2838c1c185	patch
https://git.kernel.org/stable/c/b9c826916fdce6419b94eb0cd8810fdac18c2386	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.