CVE-2026-43437 - Vulnerability Details

- ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()

In the drain loop, the local variable 'runtime' is reassigned to a
linked stream's runtime (runtime = s->runtime at line 2157). After
releasing the stream lock at line 2169, the code accesses
runtime->no_period_wakeup, runtime->rate, and runtime->buffer_size
(lines 2170-2178) — all referencing the linked stream's runtime without
any lock or refcount protecting its lifetime.

A concurrent close() on the linked stream's fd triggers
snd_pcm_release_substream() → snd_pcm_drop() → pcm_release_private()
→ snd_pcm_unlink() → snd_pcm_detach_substream() → kfree(runtime).
No synchronization prevents kfree(runtime) from completing while the
drain path dereferences the stale pointer.

Fix by caching the needed runtime fields (no_period_wakeup, rate,
buffer_size) into local variables while still holding the stream lock,
and using the cached values after the lock is released.

Published: 2026-05-08

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw touches the ALSA subsystem in the Linux kernel. During a pcm drain operation, a stream's runtime pointer is reused after its lock is released and a concurrent close frees the runtime structure, leaving a stale pointer that is dereferenced. This use‑after‑free can corrupt memory and, depending on context, may allow an attacker to execute arbitrary code or cause a crash.

Affected Systems

Affected systems are Linux kernel builds that include the ALSA PCM subsystem. The CVE description references the pcm drain loop around lines 2150‑2180, but no specific kernel releases or version numbers are listed. As a result, the affected version range cannot be determined solely from the provided data. Security teams should verify their kernel versions against the kernel source that contains the patch and assess whether their builds include the vulnerable code path.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. The use‑after‑free occurs during a PCM drain operation without appropriate locking, potentially allowing a concurrent close to free the runtime structure while the drain logic continues to dereference it. This flaw can lead to memory corruption within the kernel, which is a local issue. No publicly released exploit is known from the CVE data, and the EPSS score of <1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f2b3614cefb61ee6046a0aaee503ee37f227d310`	affected	< 9baee36e8c5443411c4629afabafaff8a46a23fd
`f2b3614cefb61ee6046a0aaee503ee37f227d310`	affected	< fc71f888994569f87d5bee20b1ac6c9c1e3a7a79
`f2b3614cefb61ee6046a0aaee503ee37f227d310`	affected	< 629cf09464cf98670996ea5c191dc9743e6f3f00
`f2b3614cefb61ee6046a0aaee503ee37f227d310`	affected	< ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432
`f2b3614cefb61ee6046a0aaee503ee37f227d310`	affected	< 4a758e9a1f5ed722f83c4dd35f867fe811553bcb
`f2b3614cefb61ee6046a0aaee503ee37f227d310`	affected	< c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694
`f2b3614cefb61ee6046a0aaee503ee37f227d310`	affected	< 9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6

Linux

affected

Version	Status	Constraints
`3.0`	affected	—
`0`	unaffected	< 3.0
`5.10.253`	unaffected	≤ 5.10.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.19`	unaffected	≤ 6.18.*
`6.19.9`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[f2b3614cefb61ee6046a0aaee503ee37f227d310,9baee36e8c5443411c4629afabafaff8a46a23fd)`	affected	code_commit	—
`[f2b3614cefb61ee6046a0aaee503ee37f227d310,fc71f888994569f87d5bee20b1ac6c9c1e3a7a79)`	affected	code_commit	—
`[f2b3614cefb61ee6046a0aaee503ee37f227d310,629cf09464cf98670996ea5c191dc9743e6f3f00)`	affected	code_commit	—
`[f2b3614cefb61ee6046a0aaee503ee37f227d310,ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432)`	affected	code_commit	—
`[f2b3614cefb61ee6046a0aaee503ee37f227d310,4a758e9a1f5ed722f83c4dd35f867fe811553bcb)`	affected	code_commit	—
`[f2b3614cefb61ee6046a0aaee503ee37f227d310,c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694)`	affected	code_commit	—
`[f2b3614cefb61ee6046a0aaee503ee37f227d310,9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.0`	affected	generic	—
`[0,3.0)`	unaffected	generic	—
`[5.10.253,5.11.0)`	unaffected	semver	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.78,6.13.0)`	unaffected	semver	—
`[6.18.19,6.19.0)`	unaffected	semver	—
`[6.19.9,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that contains the ALSA use‑after‑free fix
If an immediate update is not possible, restrict or block access to ALSA devices (e.g., /dev/snd/*) via ACLs or policies to reduce the chance of concurrent drain operations
Continuously monitor kernel logs and ALSA‑related events for crashes or anomalies and investigate promptly

Generated by OpenCVE AI on May 11, 2026 at 09:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4606-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00015.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4a758e9a1f5ed722f83c4dd35f867fe811553bcb
https://git.kernel.org/stable/c/629cf09464cf98670996ea5c191dc9743e6f3f00
https://git.kernel.org/stable/c/9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6
https://git.kernel.org/stable/c/9baee36e8c5443411c4629afabafaff8a46a23fd
https://git.kernel.org/stable/c/ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432
https://git.kernel.org/stable/c/c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694
https://git.kernel.org/stable/c/fc71f888994569f87d5bee20b1ac6c9c1e3a7a79
https://lore.kernel.org/linux-cve-announce/2026050853-CVE-2026-43437-be27@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43437
https://www.cve.org/CVERecord?id=CVE-2026-43437

History

Thu, 21 May 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::

Mon, 11 May 2026 07:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 09 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Sat, 09 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026050853-CVE-2026-43437-be27@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43437 https://www.cve.org/CVERecord?id=CVE-2026-43437
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 08 May 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 08 May 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() In the drain loop, the local variable 'runtime' is reassigned to a linked stream's runtime (runtime = s->runtime at line 2157). After releasing the stream lock at line 2169, the code accesses runtime->no_period_wakeup, runtime->rate, and runtime->buffer_size (lines 2170-2178) — all referencing the linked stream's runtime without any lock or refcount protecting its lifetime. A concurrent close() on the linked stream's fd triggers snd_pcm_release_substream() → snd_pcm_drop() → pcm_release_private() → snd_pcm_unlink() → snd_pcm_detach_substream() → kfree(runtime). No synchronization prevents kfree(runtime) from completing while the drain path dereferences the stale pointer. Fix by caching the needed runtime fields (no_period_wakeup, rate, buffer_size) into local variables while still holding the stream lock, and using the cached values after the lock is released.
Title		ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4a758e9a1f5ed722f83c4dd35f867fe811553bcb https://git.kernel.org/stable/c/629cf09464cf98670996ea5c191dc9743e6f3f00 https://git.kernel.org/stable/c/9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 https://git.kernel.org/stable/c/9baee36e8c5443411c4629afabafaff8a46a23fd https://git.kernel.org/stable/c/ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432 https://git.kernel.org/stable/c/c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694 https://git.kernel.org/stable/c/fc71f888994569f87d5bee20b1ac6c9c1e3a7a79

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-08T14:22:07.314Z

Updated: 2026-05-11T22:24:34.477Z

Reserved: 2026-05-01T14:12:56.009Z

Link: CVE-2026-43437

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-08T15:16:56.037

Modified: 2026-05-21T17:41:41.273

Link: CVE-2026-43437

Redhat

Severity : Moderate

Publid Date: 2026-05-08T00:00:00Z

Links: CVE-2026-43437 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-11T09:45:07Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object