PatchSiren cyber security CVE debrief

CVE-2026-46143 Linux CVE debrief

A memory leak vulnerability exists in the Qualcomm ASoC (ALSA System on Chip) q6apm-lpass-dai driver within the Linux kernel. The issue occurs because the driver's prepare callback can be invoked multiple times during playback operations, resulting in repeated graph opens without proper state tracking. Each redundant graph open allocates resources that are never released, leading to cumulative memory exhaustion over time. The vulnerability is confined to kernel-space memory management and does not provide direct attack vectors for privilege escalation or code execution. Exploitation requires local access to trigger audio playback operations that exercise the vulnerable code path. The fix introduces a state check to prevent multiple graph opens when the audio path is already prepared.

Vendor: Linux
Product: Unknown
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-28
Original CVE updated: 2026-06-24
Advisory published: 2026-05-28
Advisory updated: 2026-06-24

Who should care

Organizations running Linux systems with Qualcomm Snapdragon audio subsystems, embedded Linux deployments using LPASS (Low Power Audio SubSystem), and kernel maintainers responsible for stable branch backports

Technical summary

The q6apm-lpass-dai driver in sound/soc/qcom/ fails to track graph open state across multiple prepare() invocations. When userspace triggers audio playback, the prepare callback may be called repeatedly, each invocation opening a new graph context without checking if one already exists. This results in orphaned graph allocations and kernel memory exhaustion. The vulnerability is local-only, requires audio subsystem access, and has no demonstrated exploitability for code execution or privilege escalation. Resolution adds a conditional check to skip graph open when already initialized.

Defensive priority

medium

Recommended defensive actions

Apply kernel patches from stable branches once available through distribution channels
Monitor NVD for CVSS scoring updates as analysis completes
Review audio subsystem configurations for systems using Qualcomm LPASS hardware
Validate kernel version against patched releases: 3141d8b00cad, 69acc488aaf3, 7cab9f2ad51c, b97493f0f42a, c91b7bcc7034

Evidence notes

Vulnerability description confirms memory leak via multiple graph opens in ASoC qcom q6apm-lpass-dai driver. Five stable kernel commits provided indicate backports to multiple kernel versions. No CVSS score assigned; NVD status 'Awaiting Analysis'. No KEV listing. Vendor identification marked low confidence with review flag.

Sources and references

Verified primary and authoritative sources

CVE-2026-46143 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-46143

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-46143 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46143

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/3141d8b00cad6d3331953c79060ccc3a0262311b

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/69acc488aaf39d0ddf6c3cf0e47c1873d39919a2

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/7cab9f2ad51c858263da836baebad050a1bc7914

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/b97493f0f42ab9d882a62466782e1900e481a9d6

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/c91b7bcc70346d07f57ef03d1b9a338324e213de

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.