PT-2026-39120 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-15 · CVE-2026-43459

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the ALSA System on Chip (ASoC) core. When a sound card is unbound while a PCM stream is open, the close delayed work workqueue handler calls snd soc dapm stream event(). During the unbind process, snd card disconnect sync() releases PCM file descriptors, which may trigger snd soc dapm stream stop() to schedule new delayed work. Because this occurs after the initial flush in snd soc unbind card(), the new work remains pending. Subsequently, soc remove link components() frees DAPM widgets before the pending work executes, resulting in a use-after-free condition.

Recommendations Apply the update that introduces a flush in soc cleanup card resources() after snd card disconnect sync() and before soc remove link dais() and soc remove link components().

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-43459

Affected Products

Linux Kernel

References · 19

• https://git.kernel.org/stable/c/3887e514978d28216246360b46a9cb534969eb5a · Patch
• https://ubuntu.com/security/CVE-2026-43459 · Vendor Advisory
• https://git.kernel.org/stable/c/317a9298c54bb00319da73e5a7179f00e67fcbdf · Patch
• https://git.kernel.org/stable/c/bf80a89da97285d9b877e0c6995e870d46b8025c · Patch
• https://git.kernel.org/stable/c/c054f0607c8bb1b1aa529bc109e4149298a1cccd · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43459 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43459 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43459 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43459 · Vendor Advisory
• https://git.kernel.org/stable/c/7d33e6140945482a07f8089ee86e13e02553ffdb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43459 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-43459 · Security Note
• https://git.kernel.org/stable/c/95bc5c225513fc3c4ce169563fb5e3929fbb938b · Patch
• https://git.kernel.org/stable/c/eab71e11ce2447c1e01809cbc11eab4234cf8dc8 · Patch
• https://git.kernel.org/stable/c/231568afbc0cd25b8fb2a94ebf9738eabe1cf007 · Patch