All vulnerabilities
CVE-2026-99068

Linux: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in0919d8dd19f92e12829055c75fced9a454d644bfAlso 593d46fc6af9a0178a46e77d6d24b20d2314165fCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 0919d8dd19f92e12829055c75fced9a454d644bfLinuxCVE List
  • 593d46fc6af9a0178a46e77d6d24b20d2314165fLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers

Commit e576e7843c0d ("ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions") centralized the DAO input mapper clearing logic in dao_clear_input(), but omitted the kfree() calls.

It removes the mapper entries from the list and sets their pointers to NULL without freeing the allocated array. This leaks memory each time dao_clear_input() is called.

Store the base pointer of the allocation before clearing the mapper entries and free the array after removing entries from the list.

Text from CVE List

Affected versions 8

  • Linuxaffected: e576e7843c0d65b82d4092e5b386d9fbf5bc10c3 before f7dc71c1ce885f5d9f128037ebc75d9c0356e060CVE List
  • Linuxaffected: e576e7843c0d65b82d4092e5b386d9fbf5bc10c3 before 0919d8dd19f92e12829055c75fced9a454d644bfCVE List
  • Linuxaffected: e576e7843c0d65b82d4092e5b386d9fbf5bc10c3 before 593d46fc6af9a0178a46e77d6d24b20d2314165fCVE List
  • Linuxaffected: 6.14CVE List
  • Linuxunaffected: all versions before 6.14CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3