CVE-2026-89943 ASoC: loongson: Fix error handling in ACPI property parsing
An attacker with local access could trigger a kernel crash by exploiting an uninitialized pointer in the Loongson ASoC driver's ACPI property parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89943?
CVE-2026-89943 is a high-severity vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: loongson: Fix error handling in ACPI property parsing
In loongson_card_parse_acpi(), the return value of device_property_read_string() for the `codec-dai-name` property was ignored. If the property is missing or invalid, an uninitialized pointer would be used later, potentially leading to undefined behavior.
Fix this by checking the return value and propagating the error appropriately.
Which versions are affected by CVE-2026-89943?
How do I fix CVE-2026-89943?
Apply the vendor's patch.
Is CVE-2026-89943 being exploited?
There is no known exploitation of CVE-2026-89943 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-89943, DEBIAN-CVE-2026-89943, GHSA-r596-mvwg-48gr, UBUNTU-CVE-2026-89943.