CVE-2026-99068

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99068", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.389Z", "datePublished": "2026-10-23T12:23:11.461Z", "dateUpdated": "2026-10-23T12:23:11.461Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T12:23:11.461Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Fix memory leakage when clearing DAO input mappers\n\nCommit e576e7843c0d (\"ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions\")\ncentralized the DAO input mapper clearing logic in\ndao_clear_input(), but omitted the kfree() calls.\n\nIt removes the mapper entries from the list and sets their pointers\nto NULL without freeing the allocated array. This leaks memory each\ntime dao_clear_input() is called.\n\nStore the base pointer of the allocation before clearing the mapper\nentries and free the array after removing entries from the list."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/pci/ctxfi/ctdaio.c"], "versions": [{"version": "e576e7843c0d65b82d4092e5b386d9fbf5bc10c3", "lessThan": "f7dc71c1ce885f5d9f128037ebc75d9c0356e060", "status": "affected", "versionType": "git"}, {"version": "e576e7843c0d65b82d4092e5b386d9fbf5bc10c3", "lessThan": "0919d8dd19f92e12829055c75fced9a454d644bf", "status": "affected", "versionType": "git"}, {"version": "e576e7843c0d65b82d4092e5b386d9fbf5bc10c3", "lessThan": "593d46fc6af9a0178a46e77d6d24b20d2314165f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/pci/ctxfi/ctdaio.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f7dc71c1ce885f5d9f128037ebc75d9c0356e060"}, {"url": "https://git.kernel.org/stable/c/0919d8dd19f92e12829055c75fced9a454d644bf"}, {"url": "https://git.kernel.org/stable/c/593d46fc6af9a0178a46e77d6d24b20d2314165f"}], "title": "ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/pci/ctxfi/ctdaio.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f7dc71c1ce885f5d9f128037ebc75d9c0356e060", "status": "affected", "version": "e576e7843c0d65b82d4092e5b386d9fbf5bc10c3", "versionType": "git"}, {"lessThan": "0919d8dd19f92e12829055c75fced9a454d644bf", "status": "affected", "version": "e576e7843c0d65b82d4092e5b386d9fbf5bc10c3", "versionType": "git"}, {"lessThan": "593d46fc6af9a0178a46e77d6d24b20d2314165f", "status": "affected", "version": "e576e7843c0d65b82d4092e5b386d9fbf5bc10c3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/pci/ctxfi/ctdaio.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Fix memory leakage when clearing DAO input mappers\n\nCommit e576e7843c0d (\"ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions\")\ncentralized the DAO input mapper clearing logic in\ndao_clear_input(), but omitted the kfree() calls.\n\nIt removes the mapper entries from the list and sets their pointers\nto NULL without freeing the allocated array. This leaks memory each\ntime dao_clear_input() is called.\n\nStore the base pointer of the allocation before clearing the mapper\nentries and free the array after removing entries from the list."}], "id": "CVE-2026-99068", "lastModified": "2026-10-23T13:17:30.693", "metrics": {}, "published": "2026-10-23T13:17:30.693", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0919d8dd19f92e12829055c75fced9a454d644bf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/593d46fc6af9a0178a46e77d6d24b20d2314165f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f7dc71c1ce885f5d9f128037ebc75d9c0356e060"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers", "id": "2559813", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559813"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: ctxfi: Fix memory leakage when clearing DAO input mappers\nCommit e576e7843c0d (\"ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions\")\ncentralized the DAO input mapper clearing logic in\ndao_clear_input(), but omitted the kfree() calls.\nIt removes the mapper entries from the list and sets their pointers\nto NULL without freeing the allocated array. This leaks memory each\ntime dao_clear_input() is called.\nStore the base pointer of the allocation before clearing the mapper\nentries and free the array after removing entries from the list.", "A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) ctxfi driver. When clearing Digital Audio Output (DAO) input mapping entries, the driver fails to properly free allocated memory. A local user could exploit this vulnerability by repeatedly triggering the operation, causing a memory leak that can lead to a Denial of Service (DoS) through system memory exhaustion."], "name": "CVE-2026-99068", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99068\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99068\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99068.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e576e7843c0d65b82d4092e5b386d9fbf5bc10c3,f7dc71c1ce885f5d9f128037ebc75d9c0356e060)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e576e7843c0d65b82d4092e5b386d9fbf5bc10c3,0919d8dd19f92e12829055c75fced9a454d644bf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e576e7843c0d65b82d4092e5b386d9fbf5bc10c3,593d46fc6af9a0178a46e77d6d24b20d2314165f)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e576e7843c0d65b82d4092e5b386d9fbf5bc10c3,f7dc71c1ce885f5d9f128037ebc75d9c0356e060)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e576e7843c0d65b82d4092e5b386d9fbf5bc10c3,0919d8dd19f92e12829055c75fced9a454d644bf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e576e7843c0d65b82d4092e5b386d9fbf5bc10c3,593d46fc6af9a0178a46e77d6d24b20d2314165f)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T16:45:17.942895+00:00", "updated": "2026-10-27T10:45:06.390601+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}