UBUNTU-CVE-2026-89944: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ASoC: hdachda: Fix hlink refcount leak on component registration failure hdachdadevprobe() gets the HDA link with sndhdacextbuslinkget() before registering the ASoC component. If component registration fails, the function returns without dropping the link reference. Always call sndhdacextbuslinkput() after the registration attempt so the reference taken during probe is balanced on both success and failure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In hdac_hda_dev_probe(), always call snd_hdac_ext_bus_link_put() after the ASoC component registration attempt so the reference acquired by snd_hdac_ext_bus_link_get() is released on both success and failure.
Event History
Frequently Asked Questions
Which Ubuntu kernel package variants are listed as affected?
The listed packages are ubuntu/linux, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-fips, ubuntu/linux-gcp-fips, and ubuntu/linux-realtime.
Under what condition does the reference leak occur?
The leak occurs when ASoC component registration fails after hdac_hda_dev_probe() has obtained an HDA link reference. A successful component registration does not follow the vulnerable early-return path described.