CVE-2026-90214: ASoC: xilinx: formatter_pcm: fix stream_data leak on open error

CVE-2026-90214: ASoC: xilinx: formatter_pcm: fix stream_data leak on open error

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ASoC: xilinx: formatter_pcm: fix stream_data leak on open error

In xlnx_formatter_pcm_open(), stream_data is allocated and
adata->play_stream or adata->capture_stream is assigned early.  If a
later step, such as snd_pcm_hw_constraint_step() or
snd_pcm_hw_constraint_integer(), fails, the function returns the error
immediately.  ALSA does not call the close callback when open fails, so
stream_data is leaked and the stream pointer is left dangling, pointing
to a substream that ALSA frees.  A later interrupt would then call
snd_pcm_period_elapsed() on the freed substream.

Free stream_data and clear the stream pointer on the error paths.

The Linux kernel CVE team has assigned CVE-2026-90214 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 5.10.270 with commit 5e1a2d9fff57f3a2b1a0f54d128d64245a253004
	Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 5.15.221 with commit edf81b293cba1b00a5e71becf184414f6991a6ca
	Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 6.1.188 with commit 3fd89a51b8cfe788df67f54b716b305dd45b8468
	Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 6.6.157 with commit 8c38ae4a465691947977c25d10394da22a64a19f
	Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 6.12.110 with commit 9030aa4e14b704dc39ee208207cb65064020d857
	Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 6.18.52 with commit 8b30628dfc2b2fad3b55a9441776a226035045fa
	Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 7.2.6 with commit 4e0ce77df7d9808926719d7950a07fbad14ea9ef
	Issue introduced in 5.1 with commit 6f6c3c36f0917be24587eeba818ab4fdfcb5465a and fixed in 7.3-rc1 with commit b992511180e126150c6ad3580a6fd568c385f4c6

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-90214
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/soc/xilinx/xlnx_formatter_pcm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5e1a2d9fff57f3a2b1a0f54d128d64245a253004
	https://git.kernel.org/stable/c/edf81b293cba1b00a5e71becf184414f6991a6ca
	https://git.kernel.org/stable/c/3fd89a51b8cfe788df67f54b716b305dd45b8468
	https://git.kernel.org/stable/c/8c38ae4a465691947977c25d10394da22a64a19f
	https://git.kernel.org/stable/c/9030aa4e14b704dc39ee208207cb65064020d857
	https://git.kernel.org/stable/c/8b30628dfc2b2fad3b55a9441776a226035045fa
	https://git.kernel.org/stable/c/4e0ce77df7d9808926719d7950a07fbad14ea9ef
	https://git.kernel.org/stable/c/b992511180e126150c6ad3580a6fd568c385f4c6