Junglewise Threat Intelligence

CVE-2026-31587: Linux Kernel Qualcomm q6apm use-after-free in ASoC component

CVE-2026-31587 · Severity: high · CVSS 7.8 · Published 2026-04-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Qualcomm audio driver (q6apm) that could lead to system instability or unauthorized memory access. The issue occurs during the cleanup process of audio components, where certain internal data structures are deleted in the wrong order, potentially allowing a malicious local user to crash the system or execute code. This affects devices using Qualcomm audio hardware running impacted versions of the Linux kernel.

Technical details

A use-after-free (UAF) vulnerability exists in the sound/soc/qcom/qdsp6/q6apm.c component of the Linux kernel. The q6apm component dynamically registers Digital Audio Interfaces (DAIs) from the ASoC topology using device-managed (devm) APIs. Because both the component and the dynamic DAIs were using managed APIs, an incorrect free ordering occurred during device unbind: DAIs were being freed while the component still held active references to them. This resulted in a slab-use-after-free in snd_soc_del_component_unlocked. The fix involves moving the component registration to an unmanaged version (snd_soc_register_component) and explicitly unregistering it in the driver's remove callback to ensure DAI pointers remain valid until the component is fully removed.

Affected products

  • Linux Linux Kernel 5.16 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1

Timeline

  • 2026-04-24: advisory: CVE-2026-31587 published by NVD
  • 2026-04-20: patched: Initial patch authored by Srinivas Kandagatla

References