CVE-2026-43459: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43459 Overview

CVE-2026-43459 is a use-after-free vulnerability in the Linux kernel's ALSA System on Chip (ASoC) subsystem. The flaw exists in the soc-core component and triggers when a sound card is unbound while a Pulse Code Modulation (PCM) stream remains open. The function snd_soc_dapm_stream_event() accesses Dynamic Audio Power Management (DAPM) widgets after they have been freed during card teardown. The race occurs because snd_card_disconnect_sync() can schedule new delayed work after the initial flush, but before soc_remove_link_components() frees the underlying structures. Exploitation requires local access and user interaction with audio devices.

Critical Impact

Local attackers with audio device access can trigger memory corruption in the kernel, leading to denial of service or potential local privilege escalation through use-after-free exploitation.

Affected Products

• Linux kernel (mainline) — ASoC soc-core subsystem
• Linux stable branches containing the vulnerable snd_soc_unbind_card() teardown path
• Distributions shipping kernels prior to the upstream stable patches referenced in the kernel.org commits

Discovery Timeline

• 2026-05-08 - CVE-2026-43459 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43459

Vulnerability Analysis

The vulnerability resides in the ASoC sound card unbind path in the Linux kernel. When userspace unbinds a sound card while a PCM stream is open, the kernel executes snd_soc_unbind_card(), which flushes pending delayed work and then invokes soc_cleanup_card_resources(). Inside cleanup, snd_card_disconnect_sync() releases all PCM file descriptors held by userspace processes.

Releasing those descriptors triggers the PCM close path, which calls snd_soc_dapm_stream_stop(). This function schedules new delayed work via the close_delayed_work handler using a pmdown_time timer delay. Because this scheduling occurs after the earlier flush, the new work item is not caught.

Subsequently, soc_remove_link_components() frees the DAPM widgets. When the previously scheduled delayed work fires, snd_soc_dapm_stream_event() dereferences widget structures that have already been released, producing a use-after-free condition [CWE-416].

Root Cause

The root cause is incorrect ordering of work flushing relative to resource teardown. The existing flush in soc_free_pcm_runtime() runs too late, executing only after soc_remove_link_components() has already freed widget memory. No barrier prevents PCM close handlers from queueing new delayed work between the initial flush and widget destruction.

Attack Vector

A local user with permission to open PCM devices under /dev/snd/ and trigger sound card unbind through sysfs or driver removal can race the close path against widget teardown. The fix adds a flush call in soc_cleanup_card_resources() after snd_card_disconnect_sync() and before soc_remove_link_dais() and soc_remove_link_components(), ensuring no scheduled work outlives the structures it accesses.

No public proof-of-concept exploit has been released. The vulnerability mechanism is documented in the upstream stable commits referenced by the Linux kernel git repository.

Detection Methods for CVE-2026-43459

Indicators of Compromise

• Kernel oops or panic messages referencing snd_soc_dapm_stream_event or close_delayed_work in dmesg output
• KASAN (Kernel Address Sanitizer) reports flagging use-after-free reads in ASoC widget structures during sound card unbind operations
• Unexpected system instability or crashes correlated with audio driver unload events (modprobe -r, sysfs unbind writes)

Detection Strategies

• Monitor kernel ring buffer logs for KASAN splats or general protection faults originating from sound/soc/soc-core.c and sound/soc/soc-dapm.c call paths
• Audit /sys/bus/*/drivers/*/unbind writes affecting sound card devices, especially when audio applications hold open PCM file descriptors
• Track kernel version reporting across the fleet to identify hosts running pre-patch builds

Monitoring Recommendations

• Forward kernel logs to a centralized logging platform and alert on traces containing ASoC function names alongside fault indicators
• Baseline the frequency of audio driver bind/unbind events and flag anomalous spikes that may indicate exploitation attempts
• Correlate audio subsystem crashes with the executing user context to detect unprivileged users triggering kernel faults

How to Mitigate CVE-2026-43459

Immediate Actions Required

• Inventory Linux systems and identify kernels lacking the upstream ASoC flush ordering fix referenced in the kernel.org stable commits
• Apply distribution security updates that incorporate the patch as soon as vendor builds are available
• Restrict unprivileged access to sound card sysfs unbind interfaces and /dev/snd/ device nodes on multi-user systems

Patch Information

The fix adds an explicit work flush in soc_cleanup_card_resources() after snd_card_disconnect_sync() and before DAI and component removal. The patch is distributed across multiple stable branches via the kernel.org commits, including commit 3887e514978d, commit 231568afbc0c, and commit 7d33e6140945. Rebuild and deploy a kernel containing the relevant backport for your stable series.

Workarounds

• Disable or blacklist unused ASoC drivers on systems that do not require audio functionality to remove the attack surface
• Limit access to driver bind/unbind sysfs entries using udev rules or restrictive filesystem permissions
• Avoid unbinding sound cards while userspace audio applications hold open PCM streams as an operational practice until patches are applied

# Restrict sysfs unbind access for audio drivers
find /sys/bus/platform/drivers -name 'unbind' -path '*snd*' \
    -exec chmod 600 {} \;

# Blacklist unused ASoC modules (example)
echo 'blacklist snd_soc_core' | sudo tee /etc/modprobe.d/disable-asoc.conf