CVE-2026-43437

Status: UPDATED  |  Advisory ID: CVE-2026-43437

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()

In the drain loop, the local variable 'runtime' is reassigned to a

linked stream's runtime (runtime = s->runtime at line 2157). After

releasing the stream lock at line 2169, the code accesses

runtime->no_period_wakeup, runtime->rate, and runtime->buffer_size

(lines 2170-2178) — all referencing the linked stream's runtime without

any lock or refcount protecting its lifetime.

A concurrent close() on the linked stream's fd triggers

snd_pcm_release_substream() → snd_pcm_drop() → pcm_release_private()

→ snd_pcm_unlink() → snd_pcm_detach_substream() → kfree(runtime).

No synchronization prevents kfree(runtime) from completing while the

drain path dereferences the stale pointer.

Fix by caching the needed runtime fields (no_period_wakeup, rate,

buffer_size) into local variables while still holding the stream lock,

and using the cached values after the lock is released. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References