From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 487F3318B9C for ; Thu, 17 Sep 2026 16:20:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789662017; cv=none; b=AbpC20dhPYap+mDC8TtJXQFQlVt2kTkd4Lg/r71daDwRSjbCxmNJQj5Ne2cB0XuP9EwVVg+mrG6wCAHAdpu5LatosCyCCWOnBGTClEIV7PjGRO8dzILvji2hvVEtzTc3pEm0tNOD01RkBBK45lqbPmzkH++zXZgVK3s6HtovqVA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789662017; c=relaxed/simple; bh=KWQM+t+QmLJivuBm1mWttuv2XldD2/2AD30drU3hHBg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nfq1+6vQG8PSiZEW0EijjEZ1TLul1X6Vt05lupPGFs+bPk4tr54LKzV+kLknolrlcfNFL/V+JGpBNg9Pa1Zq0da8RmmiQx210dRYO0BBLd8mALsz//HdO5rO3rS2fskidWHXk3djfB/P9Uo6w3XhTMdiG1FuZrMdY6vGg7g1Nzg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=uEapwXLb; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="uEapwXLb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A11FD1F000FF; Thu, 17 Sep 2026 16:20:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789662016; bh=JMWd7uo0hzjPcNRzzVYM51/LE5RKsb9z46sP4jMsawI=; h=From:To:Cc:Subject:Date:Reply-To; b=uEapwXLb4+4Cv7hrK5IGGLjU1+DC5oPoLdWmnV3cWDsdOcddytpglIg3iuKo4Oxu7 yh9Ww7qAPgdCd15o36l6/rhyC0FwB+K/QmnruGx8Y44jbRHX1Q4Nwk3yn00JV8MqEU UCgLeRUkn3B43/XcX5m1ExCcQiEczN7R2Aq77BRE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-90214: ASoC: xilinx: formatter_pcm: fix stream_data leak on open error Date: Thu, 17 Sep 2026 17:10:44 +0100 Message-ID: <2026091736-CVE-2026-90214-cdcf@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3741; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=XjhmCIRN757IkATXUUxp0YT1EH7FZvI5cN04W3bQBw8=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlrBFo/JQcGtO30mXSuMuau+keDxobeh/k1aUXTUrrjJ CZl7vDuiGVhEGRikBVTZPmyjefo/opDil6Gtqdh5rAygQxh4OIUgIms+8ewoONt076F7l7136MV JzRUnxINmbr+NMM8pfYEGW1WSQnp3AVmKtkXKi792NAPAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatter_pcm: fix stream_data leak on open error In xlnx_formatter_pcm_open(), stream_data is allocated and adata->play_stream or adata->capture_stream is assigned early. If a later step, such as snd_pcm_hw_constraint_step() or snd_pcm_hw_constraint_integer(), fails, the function returns the error immediately. ALSA does not call the close callback when open fails, so stream_data is leaked and the stream pointer is left dangling, pointing to a substream that ALSA frees. A later interrupt would then call snd_pcm_period_elapsed() on the freed substream. Free stream_data and clear the stream pointer on the error paths. The Linux kernel CVE team has assigned CVE-2026-90214 to this issue. Affected and fixed versions =========================== Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 5.10.270 with commit 5e1a2d9fff57f3a2b1a0f54d128d64245a253004 Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 5.15.221 with commit edf81b293cba1b00a5e71becf184414f6991a6ca Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 6.1.188 with commit 3fd89a51b8cfe788df67f54b716b305dd45b8468 Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 6.6.157 with commit 8c38ae4a465691947977c25d10394da22a64a19f Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 6.12.110 with commit 9030aa4e14b704dc39ee208207cb65064020d857 Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 6.18.52 with commit 8b30628dfc2b2fad3b55a9441776a226035045fa Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 7.2.6 with commit 4e0ce77df7d9808926719d7950a07fbad14ea9ef Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 7.3-rc1 with commit b992511180e126150c6ad3580a6fd568c385f4c6 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-90214 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: sound/soc/xilinx/xlnx_formatter_pcm.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/5e1a2d9fff57f3a2b1a0f54d128d64245a253004 https://git.kernel.org/stable/c/edf81b293cba1b00a5e71becf184414f6991a6ca https://git.kernel.org/stable/c/3fd89a51b8cfe788df67f54b716b305dd45b8468 https://git.kernel.org/stable/c/8c38ae4a465691947977c25d10394da22a64a19f https://git.kernel.org/stable/c/9030aa4e14b704dc39ee208207cb65064020d857 https://git.kernel.org/stable/c/8b30628dfc2b2fad3b55a9441776a226035045fa https://git.kernel.org/stable/c/4e0ce77df7d9808926719d7950a07fbad14ea9ef https://git.kernel.org/stable/c/b992511180e126150c6ad3580a6fd568c385f4c6