CVE-2026-99068 ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99068?
CVE-2026-99068 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
Commit e576e7843c0d ("ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions") centralized the DAO input mapper clearing logic in dao_clear_input(), but omitted the kfree() calls.
It removes the mapper entries from the list and sets their pointers to NULL without freeing the allocated array. This leaks memory each time dao_clear_input() is called.
Store the base pointer of the allocation before clearing the mapper entries and free the array after removing entries from the list.
Which versions are affected by CVE-2026-99068?
How do I fix CVE-2026-99068?
Upgrade to a fixed version.
Is CVE-2026-99068 being exploited?
There is no known exploitation of CVE-2026-99068 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-99068, DEBIAN-CVE-2026-99068, GHSA-8467-wmq7-xf7q, UBUNTU-CVE-2026-99068.