PT-2026-39098 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-21 · CVE-2026-43437

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the ALSA pcm component within the snd pcm drain() function. In the drain loop, the runtime variable is reassigned to a linked stream's runtime. After the stream lock is released, the system accesses runtime->no period wakeup, runtime->rate, and runtime->buffer size without a lock or reference count to protect the lifetime of the linked stream's runtime. A concurrent close() operation on the linked stream's file descriptor can trigger a sequence of functions ending in kfree(runtime), allowing the drain path to dereference a stale pointer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-43437

Affected Products

Linux Kernel

References · 19

• https://security-tracker.debian.org/tracker/CVE-2026-43437 · Vendor Advisory
• https://git.kernel.org/stable/c/629cf09464cf98670996ea5c191dc9743e6f3f00 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43437 · Security Note
• https://ubuntu.com/security/CVE-2026-43437 · Vendor Advisory
• https://git.kernel.org/stable/c/ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432 · Patch
• https://git.kernel.org/stable/c/c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694 · Patch
• https://git.kernel.org/stable/c/9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 · Patch
• https://git.kernel.org/stable/c/4a758e9a1f5ed722f83c4dd35f867fe811553bcb · Patch
• https://git.kernel.org/stable/c/9baee36e8c5443411c4629afabafaff8a46a23fd · Patch
• https://git.kernel.org/stable/c/fc71f888994569f87d5bee20b1ac6c9c1e3a7a79 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43437 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43437 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43437 · Security Note
• https://git.kernel.org/linus/9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 · Note