Skip to main content

Linux Kernel CVE-2026-43095

| EUVDEUVD-2026-27600 MEDIUM
2026-05-06 Linux
Linux Denial Of Service Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Generated
May 19, 2026 - 22:31 vuln.today
CVSS changed
May 19, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 11:31 EUVD

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SDCA: Fix errors in IRQ cleanup

IRQs are enabled through sdca_irq_populate() from component probe using devm_request_threaded_irq(), this however means the IRQs can persist if the sound card is torn down. Some of the IRQ handlers store references to the card and the kcontrols which can then fail. Some detail of the crash was explained in [1].

Generally it is not advised to use devm outside of bus probe, so the code is updated to not use devm. The IRQ requests are not moved to bus probe time as it makes passing the snd_soc_component into the IRQs very awkward and would the require a second step once the component is available, so it is simpler to just register the IRQs at this point, even though that necessitates some manual cleanup.

AnalysisAI

Linux kernel ASoC SDCA subsystem crashes on sound card teardown due to IRQ lifecycle mismanagement, causing a local denial of service. IRQ handlers registered via devm_request_threaded_irq() during component probe retain stale references to freed card and kcontrol structures after the sound card is torn down, resulting in null or dangling pointer dereferences and kernel panic. Exploitation requires local low-privilege access and SDCA-capable audio hardware; no public exploit exists and EPSS is extremely low at 0.02% (5th percentile).

Technical ContextAI

The ASoC (ALSA System on Chip) SDCA (SoundWire Device Class for Audio) subsystem manages IRQ registration for SoundWire audio hardware during component probe via sdca_irq_populate(). The root cause is a resource lifetime mismatch: devm_request_threaded_irq() ties IRQ cleanup to the bus/platform device lifetime rather than the sound card component lifetime. When the sound card is torn down before the bus device, IRQs remain registered and their handlers continue firing against freed snd_soc_component, card, and kcontrol structures. Though no CWE is formally assigned, this is characteristic of CWE-416 (Use After Free) or CWE-459 (Incomplete Cleanup). The fix replaces devm-managed IRQ allocation with explicit manual cleanup at component removal. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. SoundWire/SDCA audio is prevalent in modern Intel and AMD laptop and embedded platforms.

RemediationAI

Upgrade to Linux kernel 6.19.14 or apply the upstream stable patches directly: https://git.kernel.org/stable/c/b022da127bd9d2217e8f285e643caf5aff6f7f14 and https://git.kernel.org/stable/c/4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9. Linux 7.0 also contains the fix. For systems that cannot be immediately patched, restrict unprivileged users from triggering sound card bind/unbind cycles by blacklisting SDCA-related kernel modules via /etc/modprobe.d/ (e.g., blacklist snd-soc-sdca) - this eliminates the attack surface but disables SoundWire audio functionality. Alternatively, restrict CAP_SYS_MODULE to prevent non-root module loading. Downstream distributions (RHEL, Ubuntu, SUSE, Debian) typically backport stable kernel fixes; consult their respective security advisories for patched package versions, as the fix version numbers above apply to upstream mainline only.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43095 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy