CVE-2026-99068 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
Commit e576e7843c0d ("ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions")
centralized the DAO input mapper clearing logic in dao_clear_input(), but omitted the kfree() calls.
It removes the mapper entries from the list and sets their pointers to NULL without freeing the allocated array. This leaks memory each time dao_clear_input() is called.
Store the base pointer of the allocation before clearing the mapper entries and free the array after removing entries from the list.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the Linux kernel's ALSA subsystem, specifically within the ctxfi driver, represents a classic memory management error resulting from an incomplete refactoring effort. The issue stems from commit e576e7843c0d which aimed to simplify the dao_clear_left_input and dao_clear_right_input functions by centralizing their logic into a single dao_clear_input function. While this change improved code maintainability, it inadvertently introduced a resource leak by omitting necessary deallocation calls for dynamically allocated memory structures associated with DAO input mappers.
Technically, the flaw manifests when the dao_clear_input routine is invoked to reset or clear mapper entries. The updated logic correctly removes these entries from their respective linked lists and nullifies the pointers referencing them to prevent dangling pointer dereferences in subsequent operations. However, the function fails to invoke kfree on the underlying memory arrays that were originally allocated for these mappers. Consequently, while the kernel's internal data structures are cleaned up, the actual physical memory pages reserved by kmalloc remain unreturned to the system pool. This creates a direct discrepancy between logical resource availability and physical memory consumption.
From an operational perspective, this defect leads to progressive memory leakage within the kernel space. Each invocation of dao_clear_input results in a small but persistent loss of contiguous memory blocks that are never reclaimed until the system is rebooted or the module is unloaded. In environments where audio processing tasks frequently trigger mapper clearing operations, such as during dynamic sample rate changes or device reconfigurations on hardware utilizing the Creative X-Fi chipset family, this leak can accumulate rapidly. Over time, the continuous consumption of kernel memory depletes available resources, potentially leading to out-of-memory conditions that affect not only the ALSA subsystem but also other critical system components relying on kernel heap space.
This vulnerability aligns with CWE-401, which describes a missing release of memory after effective usage, and falls under the broader category of resource management errors. It does not directly facilitate remote code execution or privilege escalation in its current state but serves as a vector for denial-of-service attacks through resource exhaustion. An attacker could potentially exploit this by repeatedly triggering audio device reconfiguration events to accelerate memory depletion, thereby destabilizing the host system. The ATT&CK framework categorizes such behavior under techniques related to impact and persistence via resource consumption rather than direct exploitation of logic flaws for access control bypasses.
The resolution involves modifying the dao_clear_input function to preserve a reference to the base pointer of the allocated array before clearing the mapper entries from the list. Once the structural cleanup is complete, the stored pointer is passed to kfree to properly release the memory back to the kernel allocator. This ensures that every allocation has a corresponding deallocation, maintaining the integrity of the system's memory management lifecycle.
To mitigate this risk in affected systems, administrators should apply the latest available kernel updates provided by their distribution vendors which include this specific patch. For environments running custom or older kernels where immediate patching is not feasible, limiting frequent audio device reconfiguration events can reduce the rate of leakage until a permanent fix is deployed. Monitoring system memory usage for unusual growth patterns in kernel space may also serve as an early detection mechanism for similar resource leaks in other subsystems.