CVE-2026-23190: Linux Kernel Memory Leak Vulnerability

CVE-2026-23190 Overview

CVE-2026-23190 is a memory leak vulnerability in the Linux kernel's ASoC (ALSA System on Chip) AMD ACP3x PDM DMA operations. The flaw resides in the audio driver handling Pulse Density Modulation (PDM) Direct Memory Access (DMA) operations on AMD Audio Co-Processor (ACP) 3.x hardware. The vulnerability is classified under [CWE-401] Missing Release of Memory after Effective Lifetime. A local authenticated attacker can repeatedly trigger the leak to exhaust kernel memory, causing a denial of service on the affected system.

Critical Impact
Local low-privileged users can trigger kernel memory exhaustion through repeated audio DMA operations, resulting in system-wide denial of service.

Affected Products

Linux Kernel (multiple stable branches prior to fix)
Linux Kernel 6.19-rc1 through 6.19-rc8
Systems with AMD ACP3x audio hardware using PDM DMA

Discovery Timeline

2026-02-14 - CVE-2026-23190 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23190

Vulnerability Analysis

The vulnerability exists in the acp3x PDM DMA operations within the Linux kernel ASoC subsystem. The driver allocates memory during DMA setup but fails to release it under specific code paths during teardown or error handling. Each invocation of the affected operation leaks a portion of kernel memory that the allocator cannot reclaim. Over time, repeated invocations exhaust available kernel memory, leading to allocation failures and system instability.

The attack requires local access with low privileges, since interacting with the AMD ACP audio device through standard ALSA interfaces is sufficient to reach the vulnerable code path. No user interaction is required beyond initiating audio operations. The impact is limited to availability with no confidentiality or integrity exposure.

Root Cause

The root cause is an incomplete cleanup path in the acp3x PDM DMA operations. Memory allocated for DMA structures during stream setup is not freed on all exit paths. This pattern matches [CWE-401] (Missing Release of Memory after Effective Lifetime), where the reference to allocated memory is lost without invoking the corresponding free routine.

Attack Vector

A local attacker with access to the audio subsystem can open and close PCM streams on the AMD ACP3x device repeatedly. Each cycle leaks kernel memory. After sufficient iterations, the kernel exhausts memory pools, triggering out-of-memory conditions, killing processes, or rendering the host unresponsive. The vulnerability does not require root privileges, only membership in groups granting audio device access.

No public exploit code is available for CVE-2026-23190. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The mechanism is documented in the upstream kernel patch series. See the Linux Kernel Patch d7ead65 for the corrective change.

Detection Methods for CVE-2026-23190

Indicators of Compromise

Steadily increasing kernel slab memory usage visible in /proc/meminfo and /proc/slabinfo without corresponding workload growth
Out-of-memory kill events in dmesg or journalctl correlating with audio subsystem activity
Repeated open/close cycles of /dev/snd/pcm* devices from non-audio applications

Detection Strategies

Monitor kernel memory consumption trends on hosts with AMD ACP3x audio hardware and alert on sustained growth in kmalloc slab caches
Audit running kernel version against patched stable releases referenced in the upstream commits
Correlate ALSA device file descriptor activity with memory pressure indicators in host telemetry

Monitoring Recommendations

Collect kernel ring buffer logs (dmesg) for OOM events and memory allocation failures
Track slabtop output over time on affected hardware to baseline normal memory consumption
Inventory endpoints with AMD ACP3x hardware to scope exposure across the fleet

How to Mitigate CVE-2026-23190

Immediate Actions Required

Identify all Linux systems running affected kernel versions with AMD ACP3x audio hardware
Apply the upstream stable kernel patches that resolve the leak in acp3x PDM DMA operations
Restrict access to audio device nodes to trusted users where audio functionality is not required

Patch Information

The Linux kernel maintainers released fixes across multiple stable branches. Apply the kernel update corresponding to your distribution's branch. Relevant commits include Linux Kernel Patch 0e01202, Linux Kernel Patch 279cb91, Linux Kernel Patch 6d33640, Linux Kernel Patch 7f67ba5, Linux Kernel Patch 9f23800, Linux Kernel Patch c9c14d2, and Linux Kernel Patch d7ead65.

Workarounds

Blacklist the snd_acp3x_pdm_dma module on systems where AMD ACP3x audio is not needed
Tighten permissions on /dev/snd/* device nodes to limit which users can open PCM streams
Reboot affected hosts periodically to reclaim leaked memory until patches can be deployed

bash

# Blacklist the affected module until patching is complete
echo "blacklist snd_acp3x_pdm_dma" | sudo tee /etc/modprobe.d/blacklist-acp3x.conf
sudo update-initramfs -u

# Verify the running kernel version after update
uname -r