# usb: gadget: u_audio: Fix use-after-free on sound card disconnect

CVE record · `CVE-2026-89736`

- **Identifiers:** `CVE-2026-89736`
- **State:** Confirmed
- **Severity:** CVSS 7.8 High
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 11 Sept 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 11 Sept 2026, 19:46 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `33f341c1fc60e172a3515c51bdabee11e83d1ee9 to before a7ecd1a04f4f485d7be6443d0f0b2c61a800cb82` (git)
  - affected: `b131989797f7287d7fdadb2bababc05a15d44750 to before f983793f03148b097977f200298db215cd2d4438` (git)
  - affected: `3bc7324e4911351e39c54a62e6ca46321cb10faf to before 6f46762196f04464e1050a9ee94e72b917db9010` (git)
  - affected: `6c67ed9ad9b83e453e808f9b31a931a20a25629b to before 891a8d11f4d5eb50b2ce7570f4f98204a7a57493` (git)
  - affected: `6c67ed9ad9b83e453e808f9b31a931a20a25629b to before c74ff0b1a0fca53d3ac185873c87d6a719b30a47` (git)
  - affected: `6c67ed9ad9b83e453e808f9b31a931a20a25629b to before 4e747c864a88537e18b1ffc19a1954c9686bb8e1` (git)
  - affected: `6c67ed9ad9b83e453e808f9b31a931a20a25629b to before 79a92896e2bb9471550c56fc23d8d93592f04c27` (git)
  - affected: `6c67ed9ad9b83e453e808f9b31a931a20a25629b to before 858965947081d10d41d9a1010a540d3d5eea958b` (git)
  - affected: `3e016ef2e72da93a2ea7afbb45de1b481b44d761` (git)
  - affected: `3256e152b645fc1e788ba44c2d8ced690113e3e6` (git)
  - affected: `0eda2004f38d95ef5715d62be884cd344260535b` (git)
  - affected: `43ca70753dfffd517d2af126da28690f8f615605` (git)
  - and 7 more
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `6.3`
  - unaffected: `before 6.3` (semver)
  - unaffected: `5.10.270 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.221 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.188 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.157 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.109 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.50 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.4 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 7.8 High, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0013, the 2nd percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 11 Sept 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-89736](https://www.cve.org/CVERecord?id=CVE-2026-89736)
- [NVD: CVE-2026-89736](https://nvd.nist.gov/vuln/detail/CVE-2026-89736)

### References from the CNA

- <https://git.kernel.org/stable/c/a7ecd1a04f4f485d7be6443d0f0b2c61a800cb82>
- <https://git.kernel.org/stable/c/f983793f03148b097977f200298db215cd2d4438>
- <https://git.kernel.org/stable/c/6f46762196f04464e1050a9ee94e72b917db9010>
- <https://git.kernel.org/stable/c/891a8d11f4d5eb50b2ce7570f4f98204a7a57493>
- <https://git.kernel.org/stable/c/c74ff0b1a0fca53d3ac185873c87d6a719b30a47>
- <https://git.kernel.org/stable/c/4e747c864a88537e18b1ffc19a1954c9686bb8e1>
- <https://git.kernel.org/stable/c/79a92896e2bb9471550c56fc23d8d93592f04c27>
- <https://git.kernel.org/stable/c/858965947081d10d41d9a1010a540d3d5eea958b>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-89736>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-89736/>. Everything for agents: <https://agentprime.io/llms.txt>.