Executive brief
The Linux kernel audio driver (ASoC hdac_hda) has a resource leak in its hardware initialization code. When the HDA codec component fails to register, the driver does not properly release a reference it obtained earlier, gradually exhausting available resources. This could degrade system stability in edge cases or denial-of-service scenarios involving repeated probe failures.
Technical details
A resource leak exists in hdac_hda_dev_probe() in the ASoC hdac_hda codec driver. The function acquires an HDA link reference via snd_hdac_ext_bus_link_get() but fails to release it when component registration fails. The vulnerable code path skips the corresponding snd_hdac_ext_bus_link_put() call on error, causing refcount imbalance. This affects the kernel's ability to properly manage hardware link lifecycle. The fix ensures snd_hdac_ext_bus_link_put() is always called after registration attempts, whether successful or failed.
Affected products
- Linux Linux kernel multiple versions from Linux 4.x through 6.x and later
Timeline
- 2026-09-16: disclosed: CVE-2026-89944 published
- 2026-06-29: patched: Fix committed upstream by Mark Brown
- 2026-09-14: patched: Fix backported to stable kernel branches by Greg Kroah-Hartman