CVE-2026-98092: Linux Kernel ASoC Memory Leak Vulnerability

CVE-2026-98092 Overview

CVE-2026-98092 is a memory leak vulnerability in the Linux kernel's ASoC (ALSA System on Chip) AMD YC audio driver. The flaw resides in the acp6x_pdm_dma_close() function, which fails to free the runtime->private_data buffer allocated earlier in acp6x_pdm_dma_open(). Each PCM open/close cycle on affected AMD audio hardware leaks a small kernel memory allocation. The upstream fix adds the missing kfree() call to release the buffer during stream close.

Critical Impact
Repeated open and close of PCM audio streams on affected AMD platforms causes gradual kernel memory exhaustion, leading to degraded system performance or denial of service over time.

Affected Products

Linux kernel versions containing the ASoC AMD YC (acp6x) PDM DMA driver prior to the fix
Systems using AMD Audio Co-Processor 6.x hardware with pulse-density modulation (PDM) audio input
Linux stable branches patched by commits 1b67e0d, 8069bc3, ac961c3, and ecd88ef

Discovery Timeline

2026-09-25 - CVE-2026-98092 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-98092

Vulnerability Analysis

The vulnerability is a kernel memory leak [CWE-401] in the AMD ACP6x PDM DMA audio driver. When a userspace application opens a PCM substream, acp6x_pdm_dma_open() allocates a private data structure and attaches it to runtime->private_data. The symmetric close path, acp6x_pdm_dma_close(), tears down the DMA state but never calls kfree() on that allocation. The buffer is orphaned once the runtime structure is released, resulting in unreclaimable kernel heap memory.

While individual leaks are small, the cumulative effect scales with the number of audio stream open/close operations. Long-running desktops, video conferencing workloads, or malicious local processes that repeatedly open and close the PCM device can drive kernel memory consumption upward until allocation pressure impacts system stability.

Root Cause

The root cause is an unbalanced allocation and release pair. acp6x_pdm_dma_open() allocates runtime->private_data using a kernel allocator, but acp6x_pdm_dma_close() omits the corresponding kfree() call. The fix, applied across multiple stable branches, adds the missing free so each allocation on open is matched by a release on close.

Attack Vector

Exploitation requires local access to the audio device node, typically /dev/snd/pcm*. A local user with permission to open the PCM capture device can script repeated open and close operations to amplify the leak. There is no remote attack vector and no privilege escalation; the practical impact is denial of service through kernel memory exhaustion on sustained abuse.

See the upstream patches for implementation details: Linux Kernel Commit 1b67e0d, Linux Kernel Commit 8069bc3, Linux Kernel Commit ac961c3, and Linux Kernel Commit ecd88ef.

Detection Methods for CVE-2026-98092

Indicators of Compromise

Gradual, unexplained growth in kernel slab memory on systems with AMD ACP6x audio hardware
Unusual process activity repeatedly opening and closing /dev/snd/pcmC*D*c capture devices
kmemleak reports pointing to allocations originating in acp6x_pdm_dma_open()

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test systems and scan for leak reports referencing the snd_soc_acp6x module
Compare running kernel version against the fixed stable releases referenced in the upstream commits
Audit loaded audio modules with lsmod | grep acp6x to identify hosts exposed to the vulnerable driver

Monitoring Recommendations

Track /proc/meminfoSlab and SUnreclaim trends over time on affected endpoints
Alert on processes performing high-frequency open()/close() syscalls against ALSA PCM device nodes
Collect kernel logs for allocation failure warnings tied to the ASoC subsystem

How to Mitigate CVE-2026-98092

Immediate Actions Required

Update to a Linux kernel release that includes commits 1b67e0d, 8069bc3, ac961c3, or ecd88ef on the appropriate stable branch
Inventory endpoints and servers using AMD ACP6x audio hardware and prioritize them for patching
Restrict local access to ALSA PCM device nodes on multi-user systems

Patch Information

The fix adds the missing kfree(runtime->private_data) call in acp6x_pdm_dma_close(), restoring symmetry with the allocation performed in acp6x_pdm_dma_open(). The patch is available on multiple Linux stable branches via the commits listed in the external references. Distribution vendors are expected to backport the fix in subsequent kernel updates.

Workarounds

Unload the snd_soc_acp6x module on systems that do not require AMD PDM audio input using modprobe -r snd_soc_acp6x
Blacklist the vulnerable driver via /etc/modprobe.d/ on hosts where audio capture is not needed
Limit permissions on /dev/snd/pcm* device nodes so only trusted users and services can open PCM streams

bash

# Configuration example: blacklist the vulnerable driver until patched
echo "blacklist snd_soc_acp6x" | sudo tee /etc/modprobe.d/cve-2026-98092.conf
sudo modprobe -r snd_soc_acp6x