# media: usbtv: keep device alive while ALSA card exists

CVE record · `CVE-2026-90032`

- **Identifiers:** `CVE-2026-90032`
- **State:** Confirmed
- **Severity:** CVSS 7.8 High
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 16 Sept 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 16 Sept 2026, 10:33 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `63ddf68de52efaac40a9287e44266ac30e71dd36 to before 97b5e8b22b98e287481a97a9a4cfebbb348738a5` (git)
  - affected: `63ddf68de52efaac40a9287e44266ac30e71dd36 to before 503be26ff888cb3576e55d251895d290e8146f27` (git)
  - affected: `63ddf68de52efaac40a9287e44266ac30e71dd36 to before be0f7745f883386e5263b4e475686a81dfa87175` (git)
  - affected: `63ddf68de52efaac40a9287e44266ac30e71dd36 to before 67374e3a00814dcdd46e9feca61f69f7f2d81957` (git)
  - affected: `63ddf68de52efaac40a9287e44266ac30e71dd36 to before 239d1683e08b2aee2a15ef35706e1ea9a76681d8` (git)
  - affected: `63ddf68de52efaac40a9287e44266ac30e71dd36 to before 7690a86b193271322cd31ab77349a87aa10858e4` (git)
  - affected: `63ddf68de52efaac40a9287e44266ac30e71dd36 to before 1618257cb0aba4ce342ae8c0228368c24161f5fb` (git)
  - affected: `63ddf68de52efaac40a9287e44266ac30e71dd36 to before fc530fe168bb2b745a93f553ad21fc25fd9cba3d` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `3.18`
  - unaffected: `before 3.18` (semver)
  - unaffected: `5.10.270 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.221 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.188 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.157 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.110 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.51 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.5 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 7.8 High, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0016, the 4th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 16 Sept 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-90032](https://www.cve.org/CVERecord?id=CVE-2026-90032)
- [NVD: CVE-2026-90032](https://nvd.nist.gov/vuln/detail/CVE-2026-90032)

### References from the CNA

- <https://git.kernel.org/stable/c/97b5e8b22b98e287481a97a9a4cfebbb348738a5>
- <https://git.kernel.org/stable/c/503be26ff888cb3576e55d251895d290e8146f27>
- <https://git.kernel.org/stable/c/be0f7745f883386e5263b4e475686a81dfa87175>
- <https://git.kernel.org/stable/c/67374e3a00814dcdd46e9feca61f69f7f2d81957>
- <https://git.kernel.org/stable/c/239d1683e08b2aee2a15ef35706e1ea9a76681d8>
- <https://git.kernel.org/stable/c/7690a86b193271322cd31ab77349a87aa10858e4>
- <https://git.kernel.org/stable/c/1618257cb0aba4ce342ae8c0228368c24161f5fb>
- <https://git.kernel.org/stable/c/fc530fe168bb2b745a93f553ad21fc25fd9cba3d>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-90032>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-90032/>. Everything for agents: <https://agentprime.io/llms.txt>.