Executive brief
The Linux kernel's ALSA audio driver for Yamaha PCI sound cards fails to properly clean up resources when the module is unloaded, leaving dangling pointers in memory. When an application tries to access the sound card after module removal, the kernel crashes with a page fault, causing system instability and potential denial of service.
Technical details
The vulnerability is a use-after-free error in the ALSA ymfpci driver. During a refactoring to use device-managed APIs, the call to snd_card_free() was removed but the initialization was not updated to use snd_devm_card_new(). When the module is unloaded, the sound card object is not properly freed, leaving dangling pointers. Subsequent attempts to access the card (e.g., via snd_ctl_open) trigger a page fault when dereferencing the freed memory. This affects systems with Yamaha PCI audio hardware. The fix involves replacing snd_card_new() with snd_devm_card_new() to ensure proper device-managed cleanup.
Affected products
- Linux Linux kernel 6.2.x and potentially earlier versions
Timeline
- 2025-12-30: disclosed