CVE-2026-99068

What it actually does

Missing kfree after removing DAO input mapper entries from lists and nulling pointers, causing permanent allocation leak on each dao_clear_input call.

Why it matters to the business

Kernel memory gradually consumed during normal audio operations on affected systems, eventually causing resource exhaustion or instability in long-running audio workloads.

How an attack unfolds

An attacker with local access triggers repeated audio device mapper clear operations (via ALSA ctxfi driver paths) to exhaust kernel memory without triggering any kfree, leading to denial of service.

How to fix it

Apply the upstream fix that stores the allocation base pointer before list removal and calls kfree after clearing mapper entries; update to a Linux kernel containing commit e576e7843c0d plus the described correction.

How to confirm the fix worked

Review kernel source for dao_clear_input to confirm base pointer retention and kfree presence; run memory-leak checkers or stress audio mapper operations while monitoring slab allocations.

Typical attack path

1. Obtain local access to a system using the ctxfi ALSA driver
2. Perform operations that invoke dao_clear_input (left/right mapper clearing)
3. Repeat mapper-clear sequences to accumulate unfreed allocations
4. Observe progressive kernel memory depletion until OOM or crash

How to detect it

Inspect kernel logs for repeated ctxfi mapper operations; correlate with slabinfo or kmemleak reports showing growing allocations tied to dao mapper structures; no public exploit artifacts exist.

What your security team should do

• Prioritize kernel update on any system exposing ALSA ctxfi audio devices
• Monitor for unusual kernel memory growth in audio workloads
• Disable unused audio drivers if immediate patching is delayed