Loading vulnerability…
CVE-2026-46090 is a use-after-free vulnerability in the Linux kernel's ALSA loopback driver (aloop). The flaw occurs in the format-change stop path involving loopback_check_format(), which may stop the capture side when playback starts with parameters that no longer match an already running capture stream. Although prior changes moved peer lookup under cable->lock, the subsequent snd_pcm_stop() call still executes after that lock is released. In that window, a concurrent close operation can clear the capture-side entry from cable->streams[] and detach or free its runtime while the playback trigger path still retains a stale peer substream pointer. The upstream fix adds a per-cable count of in-flight peer-stop operations before dropping cable->lock and makes free_cable() wait for those operations to complete before detaching the runtime, thereby making peer runtime lifetime explicit and preventing stale-pointer dereference.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.