Skip to main content

Linux Kernel CVE-2026-46143

| EUVDEUVD-2026-32770 MEDIUM
Memory Leak (CWE-401)
2026-05-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-4pw5-f49h-h59g
Linux Information Disclosure Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local hardware-gated access requires low-privilege user with audio device permissions (AV:L, PR:L); memory leak produces only availability impact with no confidentiality or integrity compromise.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 24, 2026 - 17:11 vuln.today
CVSS changed
Jun 24, 2026 - 17:07 NVD
5.5 (MEDIUM)
Patch available
May 28, 2026 - 12:01 EUVD
CVE Published
May 28, 2026 - 10:16 nvd
MEDIUM 5.5
CVE Published
May 28, 2026 - 10:16 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens

As prepare can be called mulitple times, this can result in multiple graph opens for playback path.

This will result in a memory leaks, fix this by adding a check before opening.

AnalysisAI

Memory leak in the Linux kernel's Qualcomm ASoC q6apm-lpass-dai audio driver allows a local low-privileged user to exhaust kernel memory by repeatedly invoking the ALSA prepare callback, which opens multiple APM graphs on the playback path without corresponding release. Affected systems are limited to those running Qualcomm LPASS audio hardware across several Linux stable branches (6.6.x, 6.9.x, 6.10, 6.12.x). No public exploit exists and EPSS at 0.02% (5th percentile) reflects negligible real-world exploitation interest; the practical impact is local denial of service on Qualcomm SoC-equipped devices.

Technical ContextAI

The vulnerable code resides in the Linux kernel's ASoC (Audio System on Chip) framework within the Qualcomm q6apm-lpass-dai driver, which interfaces with the LPASS (Low Power Audio SubSystem) DSP via the Q6 APM (Audio Processing Manager) protocol. The ALSA PCM lifecycle permits the prepare callback to be called multiple times legitimately; however, the driver failed to guard against redundant APM graph open calls, resulting in CWE-401 (Missing Release of Memory after Effective Lifetime) - each repeated prepare invocation allocates kernel memory for a new graph handle that is never freed. CPE cpe:2.3:o:linux:linux_kernel confirms the affected product scope. The bug was introduced at commit be1fae62cf25 and is present across multiple stable branches including 6.6.37-6.6.140, 6.9.8-6.10, 6.10-rc6/rc7, and 6.1.154-6.2. The 'Information Disclosure' tag in EUVD source data is inconsistent with the confirmed CVSS C:N metric and should be disregarded.

RemediationAI

Apply available stable kernel patches: upgrade to Linux 6.6.140, 6.12.88, 6.18.30, 7.0.7, or 7.1-rc1 (or later). Upstream fix commits confirmed at https://git.kernel.org/stable/c/3141d8b00cad6d3331953c79060ccc3a0262311b, https://git.kernel.org/stable/c/69acc488aaf39d0ddf6c3cf0e47c1873d39919a2, https://git.kernel.org/stable/c/7cab9f2ad51c858263da836baebad050a1bc7914, https://git.kernel.org/stable/c/b97493f0f42ab9d882a62466782e1900e481a9d6, and https://git.kernel.org/stable/c/c91b7bcc70346d07f57ef03d1b9a338324e213de. Where immediate patching is not feasible, restricting unprivileged access to ALSA audio devices by removing untrusted users from the audio group or tightening /dev/snd permissions (e.g., chmod 660) prevents exploitation at the cost of disabling audio functionality for those users. Unloading the q6apm-lpass-dai kernel module entirely eliminates the attack surface if audio is non-essential, but will disable Qualcomm LPASS audio subsystem functionality.

Same weakness CWE-401 – Memory Leak

View all
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1
CVE-2023-23145 HIGH POC
7.8
CVE-2022-35858 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2026-46143 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy