CVE-2026-93039

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: meson: Keep link pointers valid on realloc failure

meson_card_reallocate_links() grows the DAI link and private data

arrays with two consecutive krealloc() calls and updates the owner

pointers only after both calls have succeeded.

A successful krealloc() may move the data: it frees the old block and

returns a new one. When that happens for the link array and the second

krealloc() then fails, card->dai_link still points to the block that

krealloc() already freed, and the error path frees the new block too.

The probe error path then calls meson_card_clean_references(), which

dereferences card->dai_link and kfree()s it again, resulting in a

use-after-free and a double free.

Commit card->dai_link and card->num_links right after the first

krealloc() succeeds, so the pointer always refers to a valid allocation

that meson_card_clean_references() can walk and free. krealloc() with

__GFP_ZERO zero-initializes the adde

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References