CVE-2026-43459 ASoC: soc-core: flush delayed work before removing DAIs and widgets

What is CVE-2026-43459?

CVE-2026-43459 is a high-severity use after free vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: soc-core: flush delayed work before removing DAIs and widgets

When a sound card is unbound while a PCM stream is open, a use-after-free can occur in snd_soc_dapm_stream_event(), called from the close_delayed_work workqueue handler.

During unbind, snd_soc_unbind_card() flushes delayed work and then calls soc_cleanup_card_resources(). Inside cleanup, snd_card_disconnect_sync() releases all PCM file descriptors, and the resulting PCM close path can call snd_soc_dapm_stream_stop() which schedules new delayed work with a pmdown_time timer delay. Since this happens after the flush in snd_soc_unbind_card(), the new work is not caught. soc_remove_link_components() then frees DAPM widgets before this work fires, leading to the use-after-free.

The existing flush in soc_free_pcm_runtime() also cannot help as it runs after soc_remove_link_components() has already freed the widgets.

Add a flush in soc_cleanup_card_resources() after snd_card_disconnect_sync() (after which no new PCM closes can schedule further delayed work) and before soc_remove_link_dais() and soc_remove_link_components() (which tear down the structures the delayed work accesses).

Weakness: CWE-416

Which versions are affected by CVE-2026-43459?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-43459?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-43459 being exploited?

There is no known exploitation of CVE-2026-43459 in the wild and no public exploit code.

Other vulnerabilities in Linux kernel

• CVE-2026-53266 Linux Kernel Out-of-Bounds Write Exploited High 8.8
• CVE-2013-6282 Linux Kernel Improper Input Validation Exploited High 8.8
• CVE-2022-0185 Linux Kernel Heap-Based Buffer Overflow Exploited High 8.4
• CVE-2013-2094 Linux Kernel Privilege Escalation Exploited High 8.4
• CVE-2026-53362 Linux Kernel Unspecified Exploited High 7.8

All Linux kernel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2026-43459, DEBIAN-CVE-2026-43459, GHSA-6hfg-rmc6-8cvm, ROOT-OS-DEBIAN-11-CVE-2026-43459, ROOT-OS-UBUNTU-2204-CVE-2026-43459, ROOT-OS-UBUNTU-2404-CVE-2026-43459 and 1 more.