CVE-2026-53065 Overview
CVE-2026-53065 is a memory leak vulnerability in the Linux kernel's ASoC (ALSA System on Chip) sti audio driver. The flaw stems from regmap_field objects allocated during player initialization that are never released. When the driver is removed, these allocations remain, leaking kernel resources over time. The upstream fix replaces the manual allocation with devm_regmap_field_alloc(), tying the lifetime of the regmap_field objects to the device lifecycle.
Critical Impact
Repeated load and unload cycles of the sti ASoC driver leak kernel memory, which can lead to resource exhaustion on long-running systems that use STMicroelectronics STi audio hardware.
Affected Products
- Linux kernel — sound/soc/sti ASoC driver
- Distributions shipping the STi ASoC driver prior to the referenced stable commits
- Embedded platforms based on STMicroelectronics STi SoCs using the in-tree ASoC driver
Discovery Timeline
- 2026-06-24 - CVE-2026-53065 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53065
Vulnerability Analysis
The Linux ASoC sti driver allocates several regmap_field structures during player initialization to access hardware register fields on STMicroelectronics STi audio controllers. The original implementation used regmap_field_alloc() without a corresponding regmap_field_free() in the driver removal path. As a result, every successful player initialization permanently consumes kernel memory associated with those field descriptors.
On systems where the driver is bound and unbound repeatedly, for example during runtime power management, hot-plug events, or test cycles, the leaked allocations accumulate. The condition is a classic [CWE-401] missing release of memory after effective lifetime. The fix migrates the affected call sites to devm_regmap_field_alloc(), which registers the allocation with the device's managed resource (devres) list so the kernel automatically frees the memory when the device is unbound.
Root Cause
The root cause is unbalanced resource management. The sti driver allocated regmap_field objects but never invoked the matching free routine during teardown, leaving the allocations orphaned in kernel memory once the device went away.
Attack Vector
The issue is not directly exploitable as a remote vulnerability. Triggering the leak requires the ability to bind and unbind the affected driver, which typically requires local privileged access. The practical impact is resource exhaustion (denial of service) on long-running embedded systems that cycle the driver.
No proof-of-concept code is required. The leak occurs as a side effect of normal driver removal. See the upstream commits for the precise fix, including Linux Kernel Commit 002a5f92 and Linux Kernel Commit 1696fad8.
Detection Methods for CVE-2026-53065
Indicators of Compromise
- Steady growth of kernel slab usage attributable to regmap allocations on systems running the sti ASoC driver.
- Repeated modprobe/rmmod or bind/unbind events targeting the STi audio driver in kernel logs.
- Long uptime systems exhibiting unexplained kernel memory pressure despite stable user-space workloads.
Detection Strategies
- Inspect /proc/slabinfo and kmemleak reports on test kernels to confirm growth of regmap_field-sized allocations after driver unbind cycles.
- Verify the running kernel version against the upstream fix commits referenced in the NVD entry to determine exposure.
- Audit configuration management data for embedded fleets to identify devices running the sti ASoC driver without the patch applied.
Monitoring Recommendations
- Track MemAvailable and kernel slab metrics over time on affected embedded devices.
- Alert on abnormal frequency of audio driver bind/unbind events in dmesg or journald.
- Include kernel version inventory in routine vulnerability scans so unpatched STi-based systems are surfaced.
How to Mitigate CVE-2026-53065
Immediate Actions Required
- Identify systems built on STMicroelectronics STi SoCs that load the in-tree ASoC sti driver.
- Upgrade the Linux kernel to a stable release that includes the referenced fix commits.
- Avoid unnecessary bind/unbind cycles of the sti audio driver until the patch is deployed.
Patch Information
The vulnerability is resolved by switching from regmap_field_alloc() to devm_regmap_field_alloc() so that the allocations are tied to the device lifetime. The fix is available in the upstream stable trees through the following commits: 002a5f92, 1696fad8, 43b67761, 4b8dba45, 7422a11a, 9641071e, a3f3c332, and c3af3bcf. Apply the patch corresponding to your stable branch.
Workarounds
- If patching is not immediately possible, keep the sti ASoC driver bound for the lifetime of the system rather than unloading it.
- Reboot affected devices on a defined maintenance cadence to reclaim leaked kernel memory.
- Restrict access to module loading and device-binding interfaces (/sys/bus/.../bind, /sys/bus/.../unbind) to root only, which is the kernel default.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
