Use-After-Free Vulnerability in Linux Kernel ALSA PCM Component

CVE-2026-43437

What is CVE-2026-43437?

A use-after-free vulnerability exists in the Linux kernel's ALSA PCM component, where a local variable 'runtime' can be reassigned to a linked stream's runtime without sufficient synchronization. This leads to a potential dereference of a stale pointer after the stream lock has been released. The vulnerability arises during the drain process when a concurrent close operation could trigger the release of memory associated with 'runtime'. The issue is resolved by caching the necessary runtime fields into local variables while keeping the stream lock, thereby preventing access to invalid memory.

References