Executive brief
The Xilinx audio SoC formatter PCM driver in the Linux kernel failed to clean up allocated memory when opening an audio stream encountered errors. If audio stream initialization fails partway through, the driver would leak memory and leave dangling pointers that could be accessed by later interrupt handlers, potentially causing kernel crashes or undefined behavior.
Technical details
A memory leak and use-after-free vulnerability exists in the xlnx_formatter_pcm_open() function in the Xilinx ASoC formatter PCM driver. The function allocates stream_data early and assigns it to a stream pointer, but if subsequent constraint-setting operations (snd_pcm_hw_constraint_step, snd_pcm_hw_constraint_integer) fail, the function returns immediately without freeing the allocated stream_data or clearing the dangling pointer. The ALSA subsystem does not invoke the close callback on failed opens, leaving the leak unresolved. A subsequent interrupt could invoke snd_pcm_period_elapsed() on the freed substream, causing a use-after-free condition. The fix adds proper error handling to free stream_data and null out stream pointers before returning errors from open failures.
Affected products
- Linux Linux kernel affected versions across multiple stable series; fix released in upstream and backported to stable branches
Timeline
- 2026-09-17: disclosed: CVE-2026-90214 published
- 2026-08-11: patched: Original fix committed by Rosen Penev
- 2026-09-14: patched: Backported to stable kernels by Greg Kroah-Hartman