High 7.8Published May 8, 2026

CVE-2026-43437ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()

Updated under an hour ago (Oct 27, 2026, 8:20 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() In the drain loop, the local variable 'runtime' is reassigned to a linked stream's runtime (runtime = s->runtime at line 2157). After releasing the stream lock at line 2169, the code accesses runtime->no_period_wakeup, runtime->rate, and runtime->buffer_size (lines 2170-2178) — all referencing the linked stream's runtime without any lock or refcount protecting its lifetime. A concurrent close() on the linked stream's fd triggers snd_pcm_release_substream() → snd_pcm_drop() → pcm_release_private() → snd_pcm_unlink() → snd_pcm_detach_substream() → kfree(runtime). No synchronization prevents kfree(runtime) from completing while the drain path dereferences the stale pointer. Fix by caching the needed runtime fields (no_period_wakeup, rate, buffer_size) into local variables while still holding the stream lock, and using the cached values after the lock is released.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f2b3614cefb61ee6046a0aaee503ee37f227d310 before 9baee36e8c5443411c4629afabafaff8a46a23fd; from f2b3614cefb61ee6046a0aaee503ee37f227d310 before f2cb2e0d27fb925c73a78f0ce7d6dbf68d3747c1; from f2b3614cefb61ee6046a0aaee503ee37f227d310 before fc71f888994569f87d5bee20b1ac6c9c1e3a7a79; from f2b3614cefb61ee6046a0aaee503ee37f227d310 before 629cf09464cf98670996ea5c191dc9743e6f3f00; from f2b3614cefb61ee6046a0aaee503ee37f227d310 before ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432; from f2b3614cefb61ee6046a0aaee503ee37f227d310 before 4a758e9a1f5ed722f83c4dd35f867fe811553bcb; from f2b3614cefb61ee6046a0aaee503ee37f227d310 before c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694; from f2b3614cefb61ee6046a0aaee503ee37f227d310 before 9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6	CNA record
linux linux_kernel linux:linux_kernel	from 3.0 before 5.10.253; from 5.11 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.19; from 6.19 before 6.19.9; 7.0; 7.0; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/9baee36e8c5443411c4629afabafaff8a46a23fd	patch
https://git.kernel.org/stable/c/f2cb2e0d27fb925c73a78f0ce7d6dbf68d3747c1
https://git.kernel.org/stable/c/fc71f888994569f87d5bee20b1ac6c9c1e3a7a79	patch
https://git.kernel.org/stable/c/629cf09464cf98670996ea5c191dc9743e6f3f00	patch
https://git.kernel.org/stable/c/ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432	patch
https://git.kernel.org/stable/c/4a758e9a1f5ed722f83c4dd35f867fe811553bcb	patch
https://git.kernel.org/stable/c/c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694	patch
https://git.kernel.org/stable/c/9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.