CVE-2026-68346: Linux Kernel Information Disclosure Flaw

CVE-2026-68346 Overview

CVE-2026-68346 affects the Linux kernel's ALSA High Definition Audio (HDA) driver for the Cirrus Logic cs35l41 smart amplifier. The function cs35l41_get_acpi_mute_state() evaluates an ACPI _DSM method to retrieve the mute state and reads the first byte of the returned object. The routine never frees the ACPI object owned by the caller, leaking memory on every successful query. It also assumes the returned object is a buffer containing at least one byte, so a malformed firmware response can trigger an invalid pointer dereference through ret->buffer.pointer.

Critical Impact
A malformed ACPI _DSM firmware response can cause an invalid pointer dereference in the kernel, and each successful mute-state query leaks the returned ACPI object.

Affected Products

Linux kernel builds including the ALSA HDA cs35l41 codec driver
Systems using Cirrus Logic CS35L41 smart amplifiers exposed through ACPI _DSM
Distributions shipping kernels prior to the fixes referenced in the stable git commits

Discovery Timeline

2026-08-10 - CVE-2026-68346 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68346

Vulnerability Analysis

The defect lives in cs35l41_get_acpi_mute_state() within the ALSA HDA cs35l41 driver. The function calls a device-specific _DSM (Device Specific Method) on the ACPI namespace to determine amplifier mute state. ACPI evaluation returns an object whose lifetime the caller owns. The driver reads a single byte from that object and returns without calling ACPI_FREE(), leaving the allocation in place. Repeated invocations accumulate leaked ACPI objects in kernel memory.

The same code path performs ret->buffer.pointer[0] without confirming that the returned object is of type ACPI_TYPE_BUFFER or that the buffer holds at least one byte. Firmware or a manipulated ACPI table can return a package, integer, or an empty buffer, causing the driver to dereference an invalid pointer inside kernel context.

Root Cause

Two defects combine in a single ACPI accessor: a missing ACPI_FREE() on the caller-owned object results in a per-call memory leak, and missing type and length validation on the _DSM result allows an out-of-bounds or type-confused read. The fix moves the code to the typed _DSM helper, validates that the buffer has at least one byte, and frees the object after the byte is consumed.

Attack Vector

Exploitation requires control over, or malformation of, the ACPI firmware or DSDT/SSDT tables consumed by the affected system. On a hardened system this is a local, high-privilege condition. On systems where firmware can be replaced or where a virtualized guest is exposed to attacker-influenced ACPI tables, a malformed _DSM response can drive the invalid pointer dereference at driver initialization or mute-state query time. See the kernel stable commit for the resolved code path.

No verified public proof-of-concept code exists. The vulnerability mechanism is documented in the kernel commit messages linked in the references section.

Detection Methods for CVE-2026-68346

Indicators of Compromise

Kernel oops or general protection fault referencing cs35l41_get_acpi_mute_state in dmesg or journalctl -k output
Steady growth of ACPI-related slab allocations correlated with audio mute-state queries
Repeated _DSM evaluation entries in ACPI debug logs without corresponding object frees

Detection Strategies

Compare the running kernel version against the fixed commits 08433c71f159, 3b597d24dc04, 7fea0c89ed39, and d5dfdf43259a published in the stable tree
Audit distribution package metadata for kernel builds shipped before the ALSA cs35l41 ACPI mute-object fix
Inspect crash dumps for faulting instruction pointers inside the cs35l41 sound codec module

Monitoring Recommendations

Ingest kernel logs into a centralized log platform and alert on oops or GPF entries naming cs35l41 or snd_hda
Track slab and vmalloc growth on long-running Linux endpoints with the cs35l41 driver loaded
Monitor firmware and BIOS update events on laptops using Cirrus Logic smart amplifiers to detect ACPI table changes

How to Mitigate CVE-2026-68346

Immediate Actions Required

Update to a Linux kernel release that incorporates the four stable commits referenced by CVE-2026-68346
On systems that cannot be patched immediately, avoid loading the snd_hda_scodec_cs35l41 module where it is not required for audio operation
Verify firmware integrity on affected laptops and reject unsigned or untrusted ACPI table modifications

Patch Information

The fix is present in the following upstream stable commits: 08433c71f159, 3b597d24dc04, 7fea0c89ed39, and d5dfdf43259a. The patches replace the raw ACPI evaluation with the typed _DSM helper, add a length check on the returned buffer, and call ACPI_FREE() on the returned object.

Workarounds

Blacklist the snd_hda_scodec_cs35l41 module on systems where audio via the CS35L41 amplifier is not required
Restrict firmware update capability to signed vendor images to prevent introduction of malformed ACPI _DSM responses
Apply distribution kernel security updates through the standard package manager as soon as they are published

bash

# Verify kernel version and confirm the cs35l41 module state
uname -r
lsmod | grep cs35l41

# Blacklist the module as a temporary mitigation
echo 'blacklist snd_hda_scodec_cs35l41' | sudo tee /etc/modprobe.d/cve-2026-68346.conf
sudo update-initramfs -u