CVE-2026-46143: Linux Kernel ASoC Memory Leak Vulnerability

CVE-2026-46143 Overview

CVE-2026-46143 is a memory leak vulnerability in the Linux kernel's ALSA System on Chip (ASoC) Qualcomm q6apm-lpass-dai driver. The flaw resides in the audio playback path handling within the Qualcomm Low Power Audio Subsystem (LPASS) Digital Audio Interface (DAI). The prepare callback can be invoked multiple times for a single playback session, causing the driver to open multiple graphs without checking whether one already exists. Each redundant open leaks kernel memory associated with the audio graph.

Critical Impact
Repeated invocation of the playback prepare path leaks kernel memory on affected Qualcomm-based Linux systems, leading to resource exhaustion over time.

Affected Products

Linux kernel — ASoC Qualcomm q6apm-lpass-dai driver
Qualcomm LPASS audio subsystem on Linux platforms
Distributions shipping the vulnerable kernel versions prior to the upstream fix

Discovery Timeline

2026-05-28 - CVE-2026-46143 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46143

Vulnerability Analysis

The vulnerability sits in the Qualcomm q6apm-lpass-dai driver, which bridges the ASoC framework with the Audio Process Manager (APM) graph in the LPASS. During audio playback setup, ASoC invokes the driver's prepare callback. The driver opens an APM graph each time prepare runs, but ASoC may legitimately call prepare more than once per stream. Each additional call opens an additional graph without releasing the prior one.

The leaked objects are kernel-allocated graph structures associated with the playback path. Repeated playback start cycles compound the leak. On long-running systems with active audio workloads, this gradually consumes kernel memory and can degrade system stability.

Root Cause

The root cause is missing state validation before resource allocation. The driver's prepare handler unconditionally calls the graph open routine without checking whether a graph is already open for the current stream. ASoC's contract permits multiple prepare invocations, so the driver must be idempotent. The upstream patch adds a guard so the graph is opened only when one is not already present.

Attack Vector

Triggering the leak requires the ability to start and restart audio playback on an affected system. A local user with access to audio devices can repeatedly open playback streams to amplify the leak. The defect is a reliability and resource exhaustion issue rather than a memory corruption or code execution flaw. See the upstream fixes in Kernel Git Commit 3141d8b, Kernel Git Commit 69acc48, Kernel Git Commit 7cab9f5, Kernel Git Commit b97493f, and Kernel Git Commit c91b7bc.

// No verified exploit code is available for this CVE.
// The fix adds a check before opening the APM graph in the
// q6apm-lpass-dai prepare callback to prevent duplicate opens.

Detection Methods for CVE-2026-46143

Indicators of Compromise

Gradual growth in kernel slab allocations attributable to Qualcomm APM graph objects on systems with active audio workloads.
dmesg entries from q6apm or related Qualcomm audio subsystem components correlating with repeated playback start events.
Unexplained reduction in available kernel memory on devices using the Qualcomm LPASS audio path.

Detection Strategies

Compare the running kernel version against the fixed commits listed in the upstream references to identify unpatched systems.
Monitor /proc/slabinfo and /proc/meminfo trends on Qualcomm-based Linux endpoints to detect anomalous kernel memory growth.
Use kmemleak during testing builds to confirm the presence of leaked graph allocations in the q6apm-lpass-dai path.

Monitoring Recommendations

Track kernel memory consumption over time on fleet endpoints and alert on sustained upward trends without corresponding workload growth.
Audit installed kernel packages across the environment to identify hosts still running pre-patch versions.
Correlate audio service restarts and playback session counts with kernel memory metrics to surface impacted devices.

How to Mitigate CVE-2026-46143

Immediate Actions Required

Apply the upstream Linux kernel patch from one of the referenced stable commits, or upgrade to a distribution kernel that includes the fix.
Inventory Qualcomm-based Linux devices using the ASoC q6apm-lpass-dai driver and prioritize them for kernel updates.
Reboot affected systems after patching to clear any memory leaked by prior playback sessions.

Patch Information

The fix adds a check in the q6apm-lpass-dai driver to avoid opening a graph when one is already open for the playback path. Patches are available in the upstream stable tree as commits 3141d8b, 69acc48, 7cab9f5, b97493f, and c91b7bc. Distribution maintainers will backport these commits into supported kernel branches.

Workarounds

Restart audio services or reboot systems periodically to reclaim leaked memory until the patch is deployed.
Limit untrusted local access to audio devices to reduce the rate at which the leak can be triggered.
Disable the affected audio path on systems where playback is not required, pending kernel updates.

bash

# Verify the running kernel version against the patched commits
uname -r

# On Debian/Ubuntu, update to a patched kernel package
sudo apt update && sudo apt upgrade linux-image-$(uname -r | sed 's/.*-//')

# On Fedora/RHEL, update the kernel
sudo dnf update kernel

# Reboot to load the patched kernel
sudo reboot