CVE-2026-23387: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23387 Overview

A double-free vulnerability has been identified in the Linux kernel's pin controller subsystem, specifically within the Cirrus Logic CS42L43 audio codec driver. The flaw exists in the cs42l43_pin_probe() function where improper error handling leads to a reference count being decremented twice, potentially causing memory corruption or system instability.

Critical Impact

This vulnerability could allow local attackers to trigger a double-free condition, potentially leading to denial of service or memory corruption on systems using the affected Cirrus Logic audio hardware.

Affected Products

• Linux kernel with pinctrl-cs42l43 driver enabled
• Systems utilizing Cirrus Logic CS42L43 audio codec hardware
• Linux kernel versions prior to the security patches

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-23387 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23387

Vulnerability Analysis

The vulnerability stems from a reference counting error in the cs42l43_pin_probe() function within the pinctrl-cs42l43 driver. When devm_add_action_or_reset() fails, it automatically invokes the cleanup action (which decrements the reference count). However, the code also contains an explicit put operation in the error handling path, resulting in a double-put (double-free) condition.

This type of memory management bug is particularly dangerous in kernel space, as it can corrupt critical kernel data structures. When a reference count is decremented below zero, the kernel may prematurely free memory that is still in use elsewhere, or attempt to free already-freed memory, leading to undefined behavior.

Root Cause

The root cause is a misunderstanding of the devm_add_action_or_reset() API semantics. This function is designed to automatically call the registered cleanup action when it fails, eliminating the need for explicit cleanup in the error path. The original code incorrectly added an explicit reference count decrement after a failed call to this function, violating the API contract and creating the double-put condition.

Attack Vector

The vulnerability requires local access to a system with the affected Cirrus Logic CS42L43 hardware and driver loaded. An attacker would need to trigger the specific error condition in the probe function, potentially through driver binding/unbinding operations or by manipulating device state to cause devm_add_action_or_reset() to fail. While the attack surface is limited to local access and specific hardware configurations, successful exploitation could lead to kernel memory corruption.

Detection Methods for CVE-2026-23387

Indicators of Compromise

• Kernel panic or oops messages referencing cs42l43_pin_probe or related pinctrl functions
• Unexpected system crashes on devices with Cirrus Logic CS42L43 audio hardware
• Memory corruption warnings in kernel logs related to the pinctrl subsystem

Detection Strategies

• Monitor kernel logs for double-free warnings using KASAN (Kernel Address Sanitizer) if enabled
• Audit loaded kernel modules for pinctrl-cs42l43 on systems with sensitive workloads
• Implement integrity monitoring for kernel memory allocation patterns

Monitoring Recommendations

• Enable kernel debugging features such as KASAN and KFENCE in development and testing environments
• Configure alerting on kernel oops and panic events, particularly those involving audio or pinctrl subsystems
• Review system stability logs for recurring crashes that may indicate exploitation attempts

How to Mitigate CVE-2026-23387

Immediate Actions Required

• Apply the latest kernel security patches from your Linux distribution
• If immediate patching is not possible, consider blacklisting the pinctrl-cs42l43 module if the hardware functionality is not critical
• Review systems with Cirrus Logic CS42L43 audio hardware for priority patching

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix removes the redundant explicit put operation in the error path, correctly relying on devm_add_action_or_reset() to handle cleanup on failure. Multiple commits have been applied to stable kernel branches:

• Kernel Git Commit 188ba34
• Kernel Git Commit 1e04651
• Kernel Git Commit 95b14ec
• Kernel Git Commit ea07fcf
• Kernel Git Commit fd5bed7

Workarounds

• Blacklist the pinctrl-cs42l43 kernel module to prevent it from loading if the CS42L43 audio hardware is not required
• Restrict local access to systems with affected hardware to trusted users only
• Monitor for and respond to kernel stability issues that may indicate exploitation attempts

# Blacklist the vulnerable module if audio functionality is not needed
echo "blacklist pinctrl-cs42l43" | sudo tee /etc/modprobe.d/blacklist-cs42l43.conf
sudo update-initramfs -u