CVE-2026-43135 Overview
CVE-2026-43135 is a resource management vulnerability in the Linux kernel's cx23885 media driver. The flaw resides in the snd_cx23885_hw_params() function, which fails to release DMA resources along its error path. When cx23885_alsa_dma_map() succeeds but a subsequent operation fails, the corresponding cx23885_alsa_dma_unmap() is never invoked. This leaks mapped DMA resources each time the error path executes. The Linux kernel maintainers have resolved the issue across multiple stable trees through eight upstream commits.
Critical Impact
Repeated triggering of the error path in snd_cx23885_hw_params() leaks DMA mappings, which can degrade system stability over time on hosts using Conexant CX23885-based capture hardware.
Affected Products
- Linux kernel media: cx23885 driver (ALSA audio capture path)
- Stable kernel branches receiving backports referenced by commits 0b7f56084c, 141c81849f, 505630dd1e, 544215cc37, 9544b73c, 9c0a6ff538, fc4df593a8, and fda46c9025
- Systems using Conexant CX23885 PCIe capture devices
Discovery Timeline
- 2026-05-06 - CVE-2026-43135 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43135
Vulnerability Analysis
The snd_cx23885_hw_params() function configures hardware parameters for ALSA audio capture on CX23885-based devices. During setup, the function calls cx23885_alsa_dma_map() to establish DMA mappings required for audio buffer transfers. If a subsequent step in the function fails, control returns to the caller without unwinding the prior DMA allocation.
The missing cleanup constitutes a memory and resource leak [CWE-401]. Each failed invocation accumulates orphaned DMA mappings that the kernel cannot reclaim until the driver is unloaded. The EPSS probability of 0.024% reflects the limited remote exploitability of a local hardware-bound resource leak.
The upstream patch adds the missing cx23885_alsa_dma_unmap() call on the error path, ensuring symmetric resource handling between success and failure exits.
Root Cause
The root cause is asymmetric resource management within snd_cx23885_hw_params(). The function acquires DMA resources through cx23885_alsa_dma_map() but lacks a corresponding release on error. This violates the kernel's standard pattern of pairing acquisition with cleanup along every exit path.
Attack Vector
Exploitation requires local access and the ability to trigger ALSA hardware parameter configuration on an affected CX23885 capture device. An attacker with permission to open the audio capture device can repeatedly invoke configurations that fail after the DMA map step. Each failure leaks DMA resources, eventually exhausting available mappings and potentially destabilizing the host.
The vulnerability is constrained to systems with the specific hardware present and active, which significantly limits its real-world reach. No public proof-of-concept code has been published, and no exploitation in the wild has been reported.
Detection Methods for CVE-2026-43135
Indicators of Compromise
- Growing DMA mapping counters or dma-buf accounting metrics on hosts with CX23885 capture hardware
- Repeated snd_cx23885_hw_params failures in dmesg without subsequent unmap log entries
- Gradual reduction in available IOMMU or swiotlb slots over driver runtime
Detection Strategies
- Compare running kernel versions against the fixed commits referenced by the upstream patches such as Linux Kernel Commit 0b7f56084c and Linux Kernel Commit fda46c9025
- Audit loaded kernel modules for cx23885 and validate the build includes the snd hw_params unmap fix
- Monitor kernel logs for repeated ALSA hw_params errors tied to the cx23885 driver
Monitoring Recommendations
- Track per-host kernel version inventory and flag systems still on unpatched stable branches
- Alert on sustained increases in DMA mapping consumption from media or sound subsystems
- Correlate hardware capture device usage with kernel error logs for anomalous failure rates
How to Mitigate CVE-2026-43135
Immediate Actions Required
- Apply the stable kernel updates that include the snd_cx23885_hw_params() unmap fix on all affected systems
- Identify hosts with CX23885 capture hardware and prioritize those for patching
- Restrict access to ALSA capture devices to trusted local users until patches are deployed
Patch Information
The fix has been merged across multiple stable Linux kernel branches. Reference commits include Linux Kernel Commit 141c81849f, Linux Kernel Commit 505630dd1e, Linux Kernel Commit 544215cc37, Linux Kernel Commit 9544b73cad, Linux Kernel Commit 9c0a6ff538, and Linux Kernel Commit fc4df593a8. Update to a distribution kernel that incorporates these commits.
Workarounds
- Blacklist the cx23885 and snd_cx23885 modules on systems that do not require the capture functionality
- Tighten permissions on /dev/snd/* device nodes to limit local users from invoking hardware parameter configuration
- Unload the driver between maintenance windows on long-running hosts to reclaim leaked DMA mappings until patches are applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
