CVE-2026-90198: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-89m9-vw2h-xgxr
Share
Published
Advisory Summary

CVE-2026-90198 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-90198 at a Glance

CVE Identifier CVE-2026-90198
GHSA Identifier GHSA-89m9-vw2h-xgxr
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-90198

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-90198, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix use-after-free in snd_card_do_free() A use-after-free was detected in snd_card_do_free() when a sound card managed by devres is unbound while a user-space application still holds an open file descriptor. For managed cards, the memory is allocated using devres_alloc(), and its release function is set to __snd_card_release(), which calls snd_card_free(). When the device is unbound, the unbind thread calls snd_card_free(), which drops a reference to the card's device. If the user thread still has an open file descriptor, the reference count does not reach zero, and the unbind thread blocks on wait_for_completion(&released). When the user thread closes the file descriptor, it drops the final reference, invoking the device release callback release_card_device(), which calls snd_card_do_free(). snd_card_do_free() performs cleanup and calls complete(card->release_completion). This wakes up the unbind thread, which returns from snd_card_free() and __snd_card_release(). The devres core then immediately frees the memory block containing the snd_card structure. Meanwhile, the user thread continues execution in snd_card_do_free() and evaluates `if (!card->managed)`. It reads the `managed` boolean from the snd_card structure that was just freed by the unbind thread, triggering a KASAN use-after-free. Fix this by caching the value of card->managed in a local variable before calling complete(). This ensures that the card pointer is not dereferenced after the unbind thread has been woken up and potentially freed the card. BUG: KASAN: use-after-free in snd_card_do_free sound/core/init.c:604 [inline] BUG: KASAN: use-after-free in release_card_device+0x1ab/0x1b0 sound/core/init.c:153 Read of size 1 at addr ffff8881912ec909 by task syz-executor130/5857 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 snd_card_do_free sound/core/init.c:604 [inline] release_card_device+0x1ab/0x1b0 sound/core/init.c:153 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 snd_card_file_remove+0x331/0x390 sound/core/init.c:1125 snd_pcm_release+0x12c/0x160 sound/core/pcm_native.c:2986 __fput+0x418/0xa50 fs/file_table.c:512 fput_close_sync+0x11f/0x240 fs/file_table.c:617 __do_sys_close fs/open.c:1511 [inline] __se_sys_close fs/open.c:1496 [inline] __x64_sys_close+0x7e/0x110 fs/open.c:1496 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>

References

NVD — CVE-2026-90198 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90198
git.kernel.org/stable/c/03c5dabc8f... WEB
https://git.kernel.org/stable/c/03c5dabc8f16bc212a5b26d2425c03a55e55a86d
git.kernel.org/stable/c/09b27dd01b... WEB
https://git.kernel.org/stable/c/09b27dd01b98480334c10bf6fb8d41d5fb063a4b
git.kernel.org/stable/c/5ae1a690c5... WEB
https://git.kernel.org/stable/c/5ae1a690c522fea2900ff56c8c2ace7b059f5e04
git.kernel.org/stable/c/6da22efb5c... WEB
https://git.kernel.org/stable/c/6da22efb5cf490b06ffbca32b10fc8af7654fee0
git.kernel.org/stable/c/7d9b5e8677... WEB
https://git.kernel.org/stable/c/7d9b5e86775fa97a487da08b9aa76e1674bf8868
git.kernel.org/stable/c/a561012868... WEB
https://git.kernel.org/stable/c/a561012868ae37c28f61fdf658bf6f251bc0e8e8
git.kernel.org/stable/c/d3d67f680d... WEB
https://git.kernel.org/stable/c/d3d67f680dbc23a5e5e3d3ecfdbf700465809877

Frequently Asked Questions

What is CVE-2026-90198?
CVE-2026-90198 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-90198?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-90198?
CVE-2026-90198 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-90198?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-89m9-vw2h-xgxr",
  "modified" : "2026-09-17T18:31:55Z",
  "published" : "2026-09-17T18:31:55Z",
  "aliases" : [ "CVE-2026-90198" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: core: Fix use-after-free in snd_card_do_free()\n\nA use-after-free was detected in snd_card_do_free() when a sound card\nmanaged by devres is unbound while a user-space application still holds an\nopen file descriptor.\n\nFor managed cards, the memory is allocated using devres_alloc(), and its\nrelease function is set to __snd_card_release(), which calls\nsnd_card_free(). When the device is unbound, the unbind thread calls\nsnd_card_free(), which drops a reference to the card's device. If the user\nthread still has an open file descriptor, the reference count does not\nreach zero, and the unbind thread blocks on wait_for_completion(&released).\n\nWhen the user thread closes the file descriptor, it drops the final\nreference, invoking the device release callback release_card_device(),\nwhich calls snd_card_do_free(). snd_card_do_free() performs cleanup and\ncalls complete(card->release_completion). This wakes up the unbind thread,\nwhich returns from snd_card_free() and __snd_card_release(). The devres\ncore then immediately frees the memory block containing the snd_card\nstructure.\n\nMeanwhile, the user thread continues execution in snd_card_do_free() and\nevaluates `if (!card->managed)`. It reads the `managed` boolean from the\nsnd_card structure that was just freed by the unbind thread, triggering a\nKASAN use-after-free.\n\nFix this by caching the value of card->managed in a local variable before\ncalling complete(). This ensures that the card pointer is not dereferenced\nafter the unbind thread has been woken up and potentially freed the card.\n\nBUG: KASAN: use-after-free in snd_card_do_free sound/core/init.c:604\n[inline]\nBUG: KASAN: use-after-free in release_card_device+0x1ab/0x1b0\nsound/core/init.c:153\nRead of size 1 at addr ffff8881912ec909 by task syz-executor130/5857\n\nCall Trace:\n <TASK>\n dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120\n print_address_description+0x55/0x1e0 mm/kasan/report.c:378\n print_report+0x58/0x70 mm/kasan/report.c:482\n kasan_report+0x117/0x150 mm/kasan/report.c:595\n snd_card_do_free sound/core/init.c:604 [inline]\n release_card_device+0x1ab/0x1b0 sound/core/init.c:153\n device_release+0xc4/0x1f0 drivers/base/core.c:-1\n kobject_cleanup lib/kobject.c:689 [inline]\n kobject_release lib/kobject.c:720 [inline]\n kref_put include/linux/kref.h:65 [inline]\n kobject_put+0x222/0x550 lib/kobject.c:737\n snd_card_file_remove+0x331/0x390 sound/core/init.c:1125\n snd_pcm_release+0x12c/0x160 sound/core/pcm_native.c:2986\n __fput+0x418/0xa50 fs/file_table.c:512\n fput_close_sync+0x11f/0x240 fs/file_table.c:617\n __do_sys_close fs/open.c:1511 [inline]\n __se_sys_close fs/open.c:1496 [inline]\n __x64_sys_close+0x7e/0x110 fs/open.c:1496\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-90198"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/03c5dabc8f16bc212a5b26d2425c03a55e55a86d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/09b27dd01b98480334c10bf6fb8d41d5fb063a4b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5ae1a690c522fea2900ff56c8c2ace7b059f5e04"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6da22efb5cf490b06ffbca32b10fc8af7654fee0"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7d9b5e86775fa97a487da08b9aa76e1674bf8868"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a561012868ae37c28f61fdf658bf6f251bc0e8e8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d3d67f680dbc23a5e5e3d3ecfdbf700465809877"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-17T17:17:14Z"
  }
}