Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-23191

CVE-2026-23191HIGH

Linux Linux — ALSA: aloop: Fix racy access at PCM trigger

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   H   L   N  U  H  H  H    7.0   .0012    1.8     —

AFFECTED
  Product  Versions                                    Fixed
  Linux    b1c73fc8e697eb73e23603e465e9af2711ed4183 –  —
  Linux    2.6.37 –                                    5.10.270

TIMELINE
  Jan 13  Reserved by Linux
  Feb 14  Published (CNA: Linux)
  Sep 14  RESCORED — CVE-2026-23191 (Linux). CVSS 7.8 → 7 (NVD).

CWE-416 · CNA: Linux · CVSS v3.1 · 7 references · NVD status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop operations are performed outside the cable lock, this may result in UAF when a program attempts to trigger frequently while opening/closing the tied stream, as spotted by fuzzers. For addressing the UAF, this patch changes two things: - It covers the most of code in loopback_check_format() with cable->lock spinlock, and add the proper NULL checks. This avoids already some racy accesses. - In addition, now we try to check the state of the capture PCM stream that may be stopped in this function, which was the major pain point leading to UAF.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 13, 2026	Reserved	Reserved by Linux
February 14, 2026	Published	Published (CNA: Linux)
September 14, 2026	RESCORED	RESCORED — CVE-2026-23191 (Linux). CVSS 7.8 → 7 (NVD).

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Linux	Linux	—	b1c73fc8e697eb73e23603e465e9af2711ed4183	—
Linux	Linux	—	2.6.37	5.10.270

Weaknesses

CWE-416

References (7)

Authoritative record: CVE-2026-23191 at cve.org

Vendors: linux

Weaknesses: CWE-416

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-23191 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.