CVE-2026-31587

Description

A flaw was found in the Linux kernel, specifically within the ASoC (ALSA System on Chip) qcom q6apm component. This vulnerability arises from incorrect memory management during the dynamic registration of digital audio interface (DAI) components. When both the component and its associated DAIs are allocated using device-managed application programming interfaces (APIs), an incorrect freeing order can occur, leading to a use-after-free condition. This can result in system instability or a denial of service.

Understanding the Weakness (CWE)

CWE-825

Confidentiality

Technical Impact: Read Memory

If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.

Availability

Technical Impact: DoS: Crash, Exit, or Restart

If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.

Integrity,Confidentiality,Availability

Technical Impact: Execute Unauthorized Code or Commands

If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.