CVE-2026-43095 Overview
CVE-2026-43095 affects the Linux kernel's ALSA System on Chip (ASoC) Sound Device Class for Audio (SDCA) subsystem. The flaw resides in the interrupt request (IRQ) cleanup path during sound card teardown. IRQs registered via sdca_irq_populate() using devm_request_threaded_irq() from the component probe can persist after the sound card is destroyed. Because some IRQ handlers retain references to the card and kcontrols, subsequent interrupt delivery can dereference freed objects and crash the kernel.
The Linux kernel maintainers have resolved the issue by removing devm lifecycle management for these IRQs and performing manual cleanup at the appropriate stage.
Critical Impact
Stale IRQ handlers can dereference freed sound card and control structures after teardown, leading to kernel crashes and potential memory corruption on systems with SDCA-capable audio hardware.
Affected Products
- Linux kernel versions containing the ASoC SDCA IRQ population code prior to the fix
- Distributions and devices shipping SoundWire SDCA-enabled audio drivers
- Stable kernel branches referenced in the upstream commits 4e53116437e9 and b022da127bd9
Discovery Timeline
- 2026-05-06 - CVE-2026-43095 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43095
Vulnerability Analysis
The vulnerability is a kernel-mode resource lifecycle flaw in the ASoC SDCA driver. The driver registers threaded interrupt handlers during component probe using the device-managed helper devm_request_threaded_irq(). The devm framework ties the lifetime of those resources to the parent device, not to the sound card object that the handlers actually reference.
When the sound card is torn down independently of the parent device, the IRQ handlers remain registered. Subsequent interrupts invoke handlers that read snd_soc_component, card, and kcontrol pointers that have already been released. The result is a kernel crash from dereferencing freed memory, with classic use-after-free semantics.
The affected callers operate in interrupt context, so the failure is non-deterministic and depends on hardware interrupt timing relative to teardown sequences.
Root Cause
The root cause is the misuse of device-managed allocation outside of bus probe scope. Kernel guidance discourages devm usage outside bus probe because the resource release point may not align with the dependent object's lifetime. Here, IRQ handlers outlived the sound card whose state they accessed.
Attack Vector
Triggering the condition requires the sound card to be torn down while the underlying device persists and continues to assert interrupts. This typically occurs through driver unbind, module reload, suspend/resume cycles, or hot-unplug events on systems with SDCA SoundWire audio peripherals. The vulnerability surface is local and bounded by physical or administrative access to the audio subsystem.
No verified public exploit code is available. The upstream commits at kernel.org commit 4e53116437e9 and kernel.org commit b022da127bd9 contain the corrective patches.
Detection Methods for CVE-2026-43095
Indicators of Compromise
- Kernel oops or panic traces referencing sdca_irq handlers, snd_soc_component, or kcontrol access after card teardown
- Repeated kernel crashes correlated with audio driver unbind, suspend/resume, or module reload events
- Stack traces showing IRQ context dereferences originating from sound/soc/sdca/ paths
Detection Strategies
- Audit running kernels for the SDCA driver version and confirm whether the upstream cleanup commits are applied
- Monitor dmesg and journalctl -k for use-after-free signatures, KASAN reports, and slab corruption warnings tied to ASoC subsystems
- Review crash dumps from kdump/kexec for handler addresses resolving inside the SDCA module
Monitoring Recommendations
- Forward kernel logs to a centralized log platform and alert on BUG:, Oops:, and KASAN: patterns referencing audio modules
- Track driver bind/unbind events through udev and correlate with subsequent interrupt-context faults
- Enable KASAN on test systems to catch latent use-after-free conditions before production exposure
How to Mitigate CVE-2026-43095
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the commits 4e53116437e9 and b022da127bd9 once distributed by your distribution vendor
- Inventory endpoints with SDCA-capable audio hardware and prioritize them for kernel updates
- Avoid manual driver unbind, repeated module reloads, or aggressive power management testing on unpatched kernels
Patch Information
The fix removes devm-managed IRQ registration in sdca_irq_populate() and introduces explicit cleanup so that IRQ handlers are unregistered before the sound card structures they reference are released. Refer to the kernel.org commit 4e53116437e9 and kernel.org commit b022da127bd9 for the exact source changes. Distribution backports should be tracked through your vendor's security advisory feeds.
Workarounds
- Where patching is delayed, restrict local access to systems with SDCA audio hardware to reduce exposure to teardown-triggered conditions
- Disable or blacklist the affected SDCA driver module on systems where audio functionality is non-essential
- Avoid suspend/resume and driver rebind workflows on unpatched kernels until updates are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
