CVE-2026-39316: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-39316 is a use-after-free (UAF) vulnerability in the OpenPrinting CUPS scheduler (cupsd) triggered when temporary printers are automatically deleted. The flaw exists in cupsdDeleteTemporaryPrinters() in scheduler/printers.c, which calls cupsdDeletePrinter() without first expiring subscriptions that reference the printer, leaving cupsd_subscription_t.dest as a dangling pointer to freed heap memory. It affects OpenPrinting CUPS versions 2.4.16 and prior; the patched version is 2.4.17. The vulnerability was published on April 7, 2026, with a CVSS v3.1 base score of 6.2 (Medium) per NVD, though the GitHub advisory rates it 4.0 (Moderate) (GitHub Advisory).

The root cause is a reference lifecycle mismatch (CWE-416: Use After Free). The IPP delete_printer() handler in scheduler/ipp.c correctly calls cupsdExpireSubscriptions(printer, NULL) before cupsdDeletePrinter(), but cupsdDeleteTemporaryPrinters() omits this step. After cupsdDeletePrinter() frees the cupsd_printer_t struct, any cupsd_subscription_t whose dest field pointed to that printer holds a dangling pointer. The dangling pointer is subsequently dereferenced in cupsdSaveAllSubscriptions() (accessing sub->dest->name) and at multiple sites in scheduler/ipp.c (lines 3490, 5014, 7014, 7031, 7732, 7901–7902, 9237), accessing fields such as ->name, ->op_policy_ptr, and ->state. The trigger sequence flows through the main scheduler loop: cupsdDeleteTemporaryPrinters() frees the printer at line 956, then cupsdCleanDirty() at line 884 calls cupsdSaveAllSubscriptions(), which dereferences the stale pointer. A proof-of-concept with step-by-step reproduction instructions and Python IPP packet construction code is publicly available (GitHub Advisory).

The confirmed impact is denial of service: any local unprivileged user can crash the cupsd root daemon by creating a temporary printer with an associated subscription and waiting for the automatic cleanup timeout, causing complete loss of printing capability until the service is manually restarted. If cupsd is configured with systemd Restart=on-failure, the crash can repeat in a loop. Beyond DoS, the advisory notes that with heap grooming, the vulnerability can potentially be leveraged for local code execution: the freed cupsd_printer_t struct (~2016 bytes) can be reclaimed by a new printer allocation, and the dangling sub->dest->op_policy_ptr field leads through a function pointer call (cupsdCheckPolicy() → cupsdFindPolicyOp() → cupsArrayFind() → array->compare()) with attacker-influenced arguments (GitHub Advisory).

A proof-of-concept exploit with detailed reproduction steps, specific configuration requirements, and Python IPP packet construction code is publicly available in the GitHub security advisory. The PoC was confirmed via AddressSanitizer on CUPS 2.4.7 and 2.5b1. Exploitation requires only local access to the CUPS socket, which is the default configuration; the CUPS-Create-Local-Printer and Create-Printer-Subscription operations do not require authentication from localhost by default. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.015% (very low), and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Prerequisite setup: Ensure the target system runs CUPS <= 2.4.16 with default localhost access policy (DefaultAuthType None, Allow all). Configure cupsd.conf with DirtyCleanInterval 1 to accelerate the cleanup cycle.
2. Pre-configure a printer: Add a printer entry in printers.conf with StateTime 0 so it is immediately eligible for deletion once marked temporary (e.g., Info UAF Test Printer, DeviceURI file:///dev/null, State Idle, Accepting Yes).
3. Create a subscription on the printer: Using Python, craft and send an IPP Create-Printer-Subscription (opcode 0x0016) request over HTTP to ipp://localhost:PORT/printers/<printername>, specifying notify-pull-method: ippget and notify-events: all. This binds a cupsd_subscription_t with dest pointing to the printer struct.
4. Mark the printer as temporary: Send a CUPS-Add-Modify-Printer (opcode 0x4003) IPP request with printer-is-temporary=true. The printer now has temporary=1 and state_time=0, making it immediately eligible for automatic deletion.
5. Trigger automatic cleanup: Wait approximately 1 second (with DirtyCleanInterval 1) for the scheduler's main loop to call cupsdDeleteTemporaryPrinters(), which frees the printer struct without expiring the subscription — leaving sub->dest as a dangling pointer.
6. Trigger the UAF dereference: Create another subscription or perform any IPP operation that causes cupsdCleanDirty() to invoke cupsdSaveAllSubscriptions(). The scheduler dereferences the freed sub->dest->name pointer, causing a crash (DoS) or, with heap grooming via a new cupsdAddPrinter() call, potential code execution through the op_policy_ptr function pointer (GitHub Advisory).

• Logs: Unexpected cupsd crash entries in /var/log/cups/error_log or systemd journal (journalctl -u cups); repeated service restarts logged by systemd if Restart=on-failure is configured.
• Process: cupsd process terminating with a segmentation fault (SIGSEGV) or abort signal; ASAN output referencing heap-use-after-free in get_subscriptions / cupsdSaveAllSubscriptions if compiled with AddressSanitizer.
• Network/Socket: Unusual IPP requests to the local CUPS socket (/var/run/cups/cups.sock or TCP port 631) from unprivileged local users, specifically Create-Printer-Subscription (opcode 0x0016) and CUPS-Add-Modify-Printer (opcode 0x4003) operations targeting the same printer in rapid succession.
• File System: Unexpected or transient entries in printers.conf for printers with StateTime 0 and temporary=1 attributes that appear and disappear rapidly (GitHub Advisory).

Upgrade OpenPrinting CUPS to version 2.4.17, which adds cupsdExpireSubscriptions(p, NULL) before cupsdDeletePrinter(p, 0) in cupsdDeleteTemporaryPrinters(), matching the safe pattern used in delete_printer(). The fix is available in commits a8ad716 (master) and 0142eeb (2.4.x branch). Distribution-specific patches have been released for Ubuntu (USN-8405-1), SUSE (SUSE-SU-2026:21787-1), Amazon Linux 2023 (ALAS2023-2026-1635), Slackware, Fedora, and openSUSE Tumbleweed. There is no configuration-level workaround; administrators may restrict access to CUPS-Create-Local-Printer by adding authentication requirements in cupsd.conf, but this breaks expected localhost functionality (GitHub Advisory, OpenPrinting Release, Ubuntu Advisory).

The vulnerability was reported by researcher Tomer-PL and fixed by OpenPrinting maintainer Mike Sweet (michaelrsweet) at the time of advisory publication. The fix was applied to both the master and 2.4.x branches simultaneously with disclosure. The oss-security mailing list carried a notification shortly after publication. Multiple Linux distributions (Ubuntu, SUSE, Fedora, Slackware, Amazon Linux, openSUSE) issued security advisories and updated packages within weeks of disclosure, indicating prompt industry response (oss-security, GitHub Advisory).