CVE-2026-43437 ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()

🗓️ 08 May 2026 14:22:07Reported by GoogleType

osv

osv🔗 osv.dev👁 1 Views

ALSA pcm drain use after free: cache runtime fields under lock to avoid freed linked stream.

Reporter	Title	Published	Views	Family All 127
attackerkb	CVE-2026-43437	8 May 202614:22	–	attackerkb
circl	CVE-2026-43437	11 May 202617:08	–	circl
cnnvd	Linux kernel 安全漏洞	8 May 202600:00	–	cnnvd
cve	CVE-2026-43437	8 May 202614:22	–	cve
cvelist	CVE-2026-43437 ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()	8 May 202614:22	–	cvelist
debian	[SECURITY] [DLA 4606-1] linux security update	29 May 202616:36	–	debian
debiancve	CVE-2026-43437	8 May 202614:22	–	debiancve
nessus	Debian dla-4606 : ata-modules-5.10.0-43-armmp-di - security update	3 Jun 202600:00	–	nessus
nessus	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50372)	6 Jul 202600:00	–	nessus
nessus	Photon OS 4.0: Linux PHSA-2026-4.0-1002	24 Apr 202600:00	–	nessus

Source	Link
git	www.git.kernel.org/stable/c/4a758e9a1f5ed722f83c4dd35f867fe811553bcb
git	www.git.kernel.org/stable/c/629cf09464cf98670996ea5c191dc9743e6f3f00
git	www.git.kernel.org/stable/c/9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6
git	www.git.kernel.org/stable/c/9baee36e8c5443411c4629afabafaff8a46a23fd
git	www.git.kernel.org/stable/c/ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432
git	www.git.kernel.org/stable/c/c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694
git	www.git.kernel.org/stable/c/fc71f888994569f87d5bee20b1ac6c9c1e3a7a79
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43437.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-43437
git	www.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

15 Jul 2026 10:14Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.8

EPSS0.00126

linux kernel pcm drain use after free linked stream runtime