CVE-2026-93039: ASoC: meson: Keep link pointers valid on realloc failure
In the Linux kernel, the following vulnerability has been resolved:
ASoC: meson: Keep link pointers valid on realloc failure
mesoncardreallocatelinks() grows the DAI link and private data arrays with two consecutive krealloc() calls and updates the owner pointers only after both calls have succeeded.
A successful krealloc() may move the data: it frees the old block and returns a new one. When that happens for the link array and the second krealloc() then fails, card->dailink still points to the block that krealloc() already freed, and the error path frees the new block too. The probe error path then calls mesoncardcleanreferences(), which dereferences card->dailink and kfree()s it again, resulting in a use-after-free and a double free.
Commit card->dailink and card->numlinks right after the first krealloc() succeeds, so the pointer always refers to a valid allocation that mesoncardcleanreferences() can walk and free. krealloc() with GFPZERO zero-initializes the added entries, so walking them on the error path is safe. With both failure paths reduced to a plain return, drop the goto labels and the error message.
Affected Software
Event History
Frequently Asked Questions
What sequence of events is required to trigger the memory-safety issue?
The DAI link array reallocation must succeed and move the allocation, followed by failure of the private-data array reallocation. The driver must then enter its probe error cleanup path.
What happens when the affected cleanup path runs?
The card's DAI-link pointer can still reference memory freed by the successful first reallocation. Cleanup then dereferences and frees that stale pointer, causing a use-after-free and a double free.