CVE-2026-23387: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23387 Overview

A double-free vulnerability has been identified in the Linux kernel's pin controller subsystem, specifically within the Cirrus Logic CS42L43 audio codec driver. The flaw exists in the cs42l43_pin_probe() function where improper error handling leads to a reference count being decremented twice, potentially causing memory corruption or system instability.

Critical Impact
This vulnerability could allow local attackers to trigger a double-free condition, potentially leading to denial of service or memory corruption on systems using the affected Cirrus Logic audio hardware.

Affected Products

Linux kernel with pinctrl-cs42l43 driver enabled
Systems utilizing Cirrus Logic CS42L43 audio codec hardware
Linux kernel versions prior to the security patches

Discovery Timeline

2026-03-25 - CVE CVE-2026-23387 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23387

Vulnerability Analysis

The vulnerability stems from a reference counting error in the cs42l43_pin_probe() function within the pinctrl-cs42l43 driver. When devm_add_action_or_reset() fails, it automatically invokes the cleanup action (which decrements the reference count). However, the code also contains an explicit put operation in the error handling path, resulting in a double-put (double-free) condition.

This type of memory management bug is particularly dangerous in kernel space, as it can corrupt critical kernel data structures. When a reference count is decremented below zero, the kernel may prematurely free memory that is still in use elsewhere, or attempt to free already-freed memory, leading to undefined behavior.

Root Cause

The root cause is a misunderstanding of the devm_add_action_or_reset() API semantics. This function is designed to automatically call the registered cleanup action when it fails, eliminating the need for explicit cleanup in the error path. The original code incorrectly added an explicit reference count decrement after a failed call to this function, violating the API contract and creating the double-put condition.

Attack Vector

The vulnerability requires local access to a system with the affected Cirrus Logic CS42L43 hardware and driver loaded. An attacker would need to trigger the specific error condition in the probe function, potentially through driver binding/unbinding operations or by manipulating device state to cause devm_add_action_or_reset() to fail. While the attack surface is limited to local access and specific hardware configurations, successful exploitation could lead to kernel memory corruption.

Detection Methods for CVE-2026-23387

Indicators of Compromise

Kernel panic or oops messages referencing cs42l43_pin_probe or related pinctrl functions
Unexpected system crashes on devices with Cirrus Logic CS42L43 audio hardware
Memory corruption warnings in kernel logs related to the pinctrl subsystem

Detection Strategies

Monitor kernel logs for double-free warnings using KASAN (Kernel Address Sanitizer) if enabled
Audit loaded kernel modules for pinctrl-cs42l43 on systems with sensitive workloads
Implement integrity monitoring for kernel memory allocation patterns

Monitoring Recommendations

Enable kernel debugging features such as KASAN and KFENCE in development and testing environments
Configure alerting on kernel oops and panic events, particularly those involving audio or pinctrl subsystems
Review system stability logs for recurring crashes that may indicate exploitation attempts

How to Mitigate CVE-2026-23387

Immediate Actions Required

Apply the latest kernel security patches from your Linux distribution
If immediate patching is not possible, consider blacklisting the pinctrl-cs42l43 module if the hardware functionality is not critical
Review systems with Cirrus Logic CS42L43 audio hardware for priority patching

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix removes the redundant explicit put operation in the error path, correctly relying on devm_add_action_or_reset() to handle cleanup on failure. Multiple commits have been applied to stable kernel branches:

Workarounds

Blacklist the pinctrl-cs42l43 kernel module to prevent it from loading if the CS42L43 audio hardware is not required
Restrict local access to systems with affected hardware to trusted users only
Monitor for and respond to kernel stability issues that may indicate exploitation attempts

bash

# Blacklist the vulnerable module if audio functionality is not needed
echo "blacklist pinctrl-cs42l43" | sudo tee /etc/modprobe.d/blacklist-cs42l43.conf
sudo update-initramfs -u