Executive brief
The Linux kernel's audio subsystem for Amlogic Meson SoCs contains a memory management bug in the DAI link reallocation function. When memory reallocation fails under specific conditions, the kernel can attempt to free the same memory block multiple times and access memory that has already been freed, potentially causing system crashes or unpredictable behavior.
Technical details
The vulnerability is a use-after-free and double-free condition in meson_card_reallocate_links() within the ASoC (ALSA System-on-Chip) Meson audio driver. The function performs two consecutive krealloc() calls to grow the DAI link and private data arrays. If the first krealloc() succeeds and relocates memory, but the second krealloc() fails, the card->dai_link pointer still references the freed old block. The error path then frees the newly allocated block, and the subsequent probe error handler calls meson_card_clean_references(), which dereferences and frees card->dai_link again, resulting in double-free and use-after-free conditions. The fix commits card->dai_link immediately after the first krealloc() succeeds, ensuring pointers always reference valid allocations. This is a kernel-level memory corruption issue affecting audio subsystem initialization on affected Meson devices.
Affected products
- Linux Linux Kernel Multiple versions (prior to fix commit 2aaa41cf974f83a6fb105422bac4e2f107150774)
Timeline
- 2026-09-17: disclosed: CVE-2026-93039 published
- 2026-07-17: patched: Upstream patch commit by Linmao Li
- 2026-09-14: patched: Fix merged into stable kernel trees