Executive brief
A vulnerability was identified in the Linux kernel's audio driver for Qualcomm chipsets. The issue occurs when the system prepares for audio playback multiple times, leading to memory leaks. Over time, this could degrade system performance or cause instability on affected devices.
Technical details
A memory leak vulnerability exists in the sound/soc/qcom/qdsp6/q6apm-lpass-dais.c component of the Linux kernel. The 'prepare' function (q6apm_lpass_dai_prepare) could be called multiple times, which previously resulted in multiple calls to q6apm_graph_open for the playback path without checking if a graph was already open. This leads to leaked memory allocations for each redundant open operation. The fix introduces a check to ensure the graph pointer is NULL before attempting to open a new graph. This issue primarily affects Qualcomm-based systems using the LPASS (Low Power Audio SubSystem) driver.
Affected products
- Linux Linux Kernel See references for specific stable branch commits
Timeline
- 2026-04-02: other: Patch authored by Srinivas Kandagatla
- 2026-05-28: advisory: CVE-2026-46143 published by NVD
References
- https://git.kernel.org/stable/c/3141d8b00cad6d3331953c79060ccc3a0262311b
- https://git.kernel.org/stable/c/69acc488aaf39d0ddf6c3cf0e47c1873d39919a2
- https://git.kernel.org/stable/c/7cab9f2ad51c858263da836baebad050a1bc7914
- https://git.kernel.org/stable/c/b97493f0f42ab9d882a62466782e1900e481a9d6
- https://git.kernel.org/stable/c/c91b7bcc70346d07f57ef03d1b9a338324e213de