CVE-2026-93039

High · 7.4

CVSS

7.4

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux kernel audio code can let a local attacker crash the system or potentially run code with elevated privileges.

Exploitation: Local Privilege
Attacker needs: Local User
Complexity: High
Impact: Full Compromise
Component: OS kernel
Class: Use After Free
Remediation: Patch
Effort: Low
Patch risk: Low

What it actually does

Use-after-free and double-free in meson_card_reallocate_links() caused by stale card->dai_link pointer after first successful krealloc() followed by failure of the second, allowing the error path and meson_card_clean_references() to dereference and free an already-freed block.

Why it matters to the business

Kernel memory corruption on affected Linux systems can produce crashes, denial of service, or potential local privilege escalation, disrupting audio functionality and overall system stability on devices using the meson ASoC driver.

How an attack unfolds

An attacker with local access triggers the audio card probe path under memory pressure so the first krealloc succeeds and moves the link array while the second fails; the subsequent error handling then uses the dangling pointer, resulting in use-after-free and double-free.

How to fix it

Apply the upstream fix that commits card->dai_link and card->num_links immediately after the first krealloc succeeds, eliminates the goto error paths, and ensures safe zero-initialized walking on failure; update to a kernel containing the commit.

How to confirm the fix worked

Inspect the meson-card.c source for the updated allocation sequence and absence of the stale-pointer window; boot the patched kernel and verify that probe failures no longer produce use-after-free or double-free reports in the kernel log.

Typical attack path

Obtain local access to a system using the meson ASoC driver
Induce audio device probe or re-probe while allocating memory pressure
Force the first krealloc to succeed and the second to fail
Allow the probe error path to execute meson_card_clean_references() on the freed pointer
Trigger repeated use-after-free or double-free to achieve memory corruption

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops, panic, or slab messages referencing use-after-free or double-free near ASoC meson card allocation and clean_references paths; correlate with recent audio device probe attempts under memory pressure.

What your security team should do

Prioritize kernel updates containing the fix for all affected meson-based devices
Restrict local unprivileged access where possible until patches are deployed
Monitor kernel logs for use-after-free signatures during audio driver initialization

The record

In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: Keep link pointers valid on realloc failure meson_card_reallocate_links() grows the DAI link and private data arrays with two consecutive krealloc() calls and updates the owner pointers only after both calls have succeeded. A successful krealloc() may move the data: it frees the old block and returns a new one. When that happens for the link array and the second krealloc() then fails, card->dai_link still points to the block that krealloc() already freed, and the error path frees the new block too. The probe error path then calls meson_card_clean_references(), which dereferences card->dai_link and kfree()s it again, resulting in a use-after-free and a double free. Commit card->dai_link and card->num_links right after the first krealloc() succeeds, so the pointer always refers to a valid allocation that meson_card_clean_references() can walk and free. krealloc() with __GFP_ZERO zero-initializes the added entries, so walking them on the error path is safe. With both failure paths reduced to a plain return, drop the goto labels and the error message.

Affected packages

Ecosystem	Package	Introduced	Fixed