GHSA-2GXQ-R2MX-5G9G
Vulnerability from github – Published: 2026-09-17 18:31 – Updated: 2026-09-17 18:31In the Linux kernel, the following vulnerability has been resolved:
ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
In xlnx_formatter_pcm_open(), stream_data is allocated and adata->play_stream or adata->capture_stream is assigned early. If a later step, such as snd_pcm_hw_constraint_step() or snd_pcm_hw_constraint_integer(), fails, the function returns the error immediately. ALSA does not call the close callback when open fails, so stream_data is leaked and the stream pointer is left dangling, pointing to a substream that ALSA frees. A later interrupt would then call snd_pcm_period_elapsed() on the freed substream.
Free stream_data and clear the stream pointer on the error paths.
{
"affected": [],
"aliases": [
"CVE-2026-90214"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T17:17:16Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: xilinx: formatter_pcm: fix stream_data leak on open error\n\nIn xlnx_formatter_pcm_open(), stream_data is allocated and\nadata-\u003eplay_stream or adata-\u003ecapture_stream is assigned early. If a\nlater step, such as snd_pcm_hw_constraint_step() or\nsnd_pcm_hw_constraint_integer(), fails, the function returns the error\nimmediately. ALSA does not call the close callback when open fails, so\nstream_data is leaked and the stream pointer is left dangling, pointing\nto a substream that ALSA frees. A later interrupt would then call\nsnd_pcm_period_elapsed() on the freed substream.\n\nFree stream_data and clear the stream pointer on the error paths.",
"id": "GHSA-2gxq-r2mx-5g9g",
"modified": "2026-09-17T18:31:56Z",
"published": "2026-09-17T18:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90214"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3fd89a51b8cfe788df67f54b716b305dd45b8468"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4e0ce77df7d9808926719d7950a07fbad14ea9ef"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5e1a2d9fff57f3a2b1a0f54d128d64245a253004"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8b30628dfc2b2fad3b55a9441776a226035045fa"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8c38ae4a465691947977c25d10394da22a64a19f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9030aa4e14b704dc39ee208207cb65064020d857"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b992511180e126150c6ad3580a6fd568c385f4c6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/edf81b293cba1b00a5e71becf184414f6991a6ca"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.