CVE-2026-90214: ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
In the Linux kernel, the following vulnerability has been resolved:
ASoC: xilinx: formatterpcm: fix streamdata leak on open error
In xlnxformatterpcmopen(), streamdata is allocated and adata->playstream or adata->capturestream is assigned early. If a later step, such as sndpcmhwconstraintstep() or sndpcmhwconstraintinteger(), fails, the function returns the error immediately. ALSA does not call the close callback when open fails, so streamdata is leaked and the stream pointer is left dangling, pointing to a substream that ALSA frees. A later interrupt would then call sndpcmperiodelapsed() on the freed substream.
Free streamdata and clear the stream pointer on the error paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In xlnx_formatter_pcm_open(), ensure stream_data is freed and the corresponding stream pointer (adata->play_stream or adata->capture_stream) is cleared on error paths when subsequent calls (e.g., snd_pcm_hw_constraint_step() or snd_pcm_hw_constraint_integer()) fail, to prevent a stream_data leak and a dangling stream pointer.
Linux kernel (ASoC: xilinx: formatter_pcm) Error-path resource handling in xlnx_formatter_pcm_open() = Free stream_data and clear adata->play_stream/adata->capture_stream on open failure paths
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux ALSA SoC xlnx_formatter_pcm driver are exposed when an affected PCM stream open operation encounters a later constraint-setup error.
What must occur for the unsafe state to be reached?
The driver must allocate stream_data and assign its playback or capture stream pointer, then a subsequent call such as snd_pcm_hw_constraint_step() or snd_pcm_hw_constraint_integer() must fail during open. ALSA does not invoke the close callback after a failed open.
What is the consequence after a failed open?
The allocated stream_data is leaked and the driver retains a dangling pointer to a substream that ALSA has freed. A later interrupt can call snd_pcm_period_elapsed() using that freed substream.
How can I tell whether a system has the fix?
Check whether the installed kernel includes one of the referenced stable commits. The fix frees stream_data and clears the playback or capture stream pointer on the open-function error paths.