CVE-2026-68346 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda: cs35l41: validate and free ACPI mute object
cs35l41_get_acpi_mute_state() evaluates a _DSM method to get the ACPI mute state and reads the first byte from the returned object.
However, the returned ACPI object is owned by the caller and is never freed after use, so each successful query leaks the _DSM result object.
The code also assumes that the returned object is a buffer with at least one byte. A malformed firmware response can return a different object type or an empty buffer, and the direct ret->buffer.pointer dereference can then access an invalid pointer.
Use the typed _DSM helper, validate that the returned buffer contains at least one byte, and free the ACPI object after reading it.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists within the Linux kernel's Advanced Linux Sound Architecture implementation specifically affecting the cs35l41 audio codec driver. The issue stems from improper handling of ACPI (Advanced Configuration and Power Interface) objects during mute state queries, creating both memory leak and potential null pointer dereference conditions. The flaw occurs in the cs35l41_get_acpi_mute_state() function which interfaces with ACPI firmware through the _DSM (Device Specific Method) interface to retrieve mute status information.
The technical implementation error involves multiple interconnected issues that compound the security risk. First, the code fails to properly manage memory allocation by not freeing the ACPI object returned from the _DSM method call. This creates a memory leak where each successful query consumes additional kernel memory without proper cleanup, potentially leading to resource exhaustion over time. Second, the code assumes the returned object is always a buffer type containing at least one byte, which violates defensive programming principles and creates a potential null pointer dereference scenario when malformed firmware responses are encountered.
The operational impact of this vulnerability extends beyond simple memory consumption issues. Attackers could potentially exploit the memory leak to cause system instability or denial of service conditions through repeated queries that gradually consume available kernel memory. The lack of validation for object types also opens possibilities for arbitrary code execution if the malformed response triggers unexpected behavior in the kernel's ACPI subsystem. This vulnerability aligns with CWE-457: Use of Uninitialized Variable and CWE-787: Out-of-bounds Write, as it involves both uninitialized memory access patterns and improper buffer boundary checking.
The fix implementation addresses these issues by utilizing the proper typed _DSM helper functions that provide better object validation and automatic cleanup mechanisms. This approach ensures that returned ACPI objects are properly validated for content type and minimum size requirements before any data extraction occurs. The solution also implements explicit object freeing after use, preventing memory leaks while maintaining proper resource management. From an ATT&CK perspective, this vulnerability relates to T1059.006: Command and Scripting Interpreter: Python and T1499.004: Endpoint Denial of Service, as it represents a kernel-level resource exhaustion vulnerability that could be exploited to degrade system performance or availability.
The mitigation strategy involves updating to kernel versions containing the patched code, which implements proper object lifecycle management and input validation for all ACPI _DSM method calls. System administrators should prioritize applying these patches, particularly on systems running audio-intensive workloads where repeated mute state queries are common. The fix also includes enhanced error handling that gracefully manages malformed firmware responses, preventing potential crashes or unexpected behavior when encountering non-compliant ACPI implementations.
This vulnerability demonstrates the importance of proper resource management in kernel space code and highlights the need for comprehensive input validation even in seemingly simple operations. The cs35l41 driver's implementation should serve as a cautionary example for other kernel subsystems that interface with ACPI firmware, emphasizing the critical requirement for memory leak prevention and robust error handling in system-level software components.