CVE-2026-43459

Vulnerability

Overview

A use-after-free vulnerability exists in the Linux kernel's ASoC (ALSA System on Chip) subsystem. The root cause is a race condition during sound card unbinding: when a PCM stream is open and the card is unbound, the close_delayed_work workqueue handler can access DAPM widgets and DAIs after they have been freed. The issue arises because snd_soc_unbind_card() flushes delayed work, but the subsequent snd_card_disconnect_sync() releases PCM file descriptors, whose close path can schedule new delayed work via snd_soc_dapm_stream_stop() with a pmdown_time timer delay. This new work is not caught by the earlier flush, and later soc_remove_link_components() frees the widgets before the work fires, leading to a use-after-free in snd_soc_dapm_stream_event() [1].

Exploitation

Scenario

An attacker with local access and the ability to open a PCM stream on an ASoC sound card can trigger the vulnerability by initiating an unbind of the sound card while the stream is active. No special privileges beyond the ability to open a PCM device are required, as the race condition occurs in normal driver teardown paths. The attack surface is limited to systems where ASoC sound cards can be dynamically unbound, such as via sysfs or module removal [1].

Impact

Successful exploitation results in a use-after-free, which can lead to memory corruption, system crash (denial of service), or potentially arbitrary code execution in kernel context. The vulnerability is rated High with a CVSS v3 score of 7.3, reflecting the potential for privilege escalation and availability impact [1].

Mitigation

The fix, introduced in Linux kernel commit 95bc5c225513, adds a flush of delayed work in soc_cleanup_card_resources() after snd_card_disconnect_sync() (which ensures no new PCM closes can schedule further work) and before soc_remove_link_dais() and s() and soc_remove_link_components() tear down the structures. This ensures all pending work is completed before the resources are freed. Users should apply the latest stable kernel updates containing this commit [1].