CVE-2026-53065: Linux Kernel STi Audio Driver Memory Leak

Technical summary

The ASoC STi audio subsystem driver allocates regmap_field objects during player initialization without corresponding deallocation. These allocations persist beyond driver removal, creating a resource leak. The vulnerability stems from manual memory management where devm_regmap_field_alloc() (device-managed allocation) should have been used instead of direct regmap_field_alloc() calls. The device-managed variant automatically frees resources when the underlying device is torn down, preventing accumulation of orphaned allocations. This is categorized as CWE-401 (Missing Release of Memory after Effective Lifetime).

Business impact

For most deployments, the practical impact is low unless the STi audio driver is repeatedly loaded and unloaded—a scenario uncommon in production systems with stable hardware configurations. However, systems with dynamic driver management, container environments with frequent module cycling, or long-running servers that periodically reconfigure audio hardware could experience gradual memory exhaustion over weeks or months. This can lead to out-of-memory conditions, system crashes, or service interruptions. Organizations relying on STi-based audio hardware (primarily embedded and specialized systems) should prioritize patching to prevent latent stability issues.

Affected systems

The vulnerability affects the Linux kernel across all versions containing the affected ASoC STi driver code. Impact is limited to systems using STi audio hardware, which is primarily found in embedded systems, set-top boxes, and certain automotive or industrial applications. Desktop, server, and cloud deployments using standard audio interfaces are not affected. The scope is narrow but includes critical infrastructure in niche markets where STi audio support is essential.

Exploitability

This vulnerability is not exploitable in the traditional sense—it requires no user interaction or malicious input. An attacker cannot directly trigger the leak to cause immediate compromise. However, if an attacker has local access and can trigger repeated driver load/unload cycles (for example, through privileged operations or container orchestration), they could accelerate memory exhaustion and cause a denial of service. The vulnerability requires local access (as indicated by AV:L in the CVSS vector) and is therefore not a remote attack vector.

Remediation

Apply the kernel patch that converts regmap_field allocations to use devm_regmap_field_alloc(). This change is minimal and non-breaking, affecting only the internal implementation of the driver without altering its API or behavior. Organizations should update their kernel to a patched version distributed by their vendor. For custom kernels or distributions with extended support timelines, backporting the fix is straightforward given its focused scope.

Patch guidance

Consult your Linux distribution or kernel vendor for an updated kernel release that includes this fix. Verify the patch commit message references the resolution of regmap_field resource leaks in the ASoC STi driver. If you maintain a custom kernel, the fix involves replacing regmap_field_alloc() calls with devm_regmap_field_alloc() in the STi audio driver initialization code. Test the patched kernel thoroughly in a staging environment, particularly if your systems actively use STi audio hardware, to ensure no regressions in audio functionality.

Detection guidance

Monitor kernel memory usage over extended periods on systems using STi audio hardware, particularly those that cycle the audio driver frequently. Elevated memory growth without corresponding application-level allocation is a warning sign. Review kernel logs for memory pressure events or out-of-memory killer activations on such systems. Kernel memory profiling tools (e.g., /proc/meminfo, slab allocator diagnostics) can help identify regmap_field object accumulation. Enable kernel debugging if you suspect this leak is impacting your infrastructure.

Why prioritize this

While the CVSS score of 5.5 (Medium) reflects limited exploitability, this vulnerability should be prioritized for systems running STi audio hardware in production, particularly those with long uptimes or dynamic driver management. The fix is low-risk and widely available, making remediation straightforward. For organizations without STi audio hardware, this is a lower priority update. However, it is still worth including in regular kernel patching cycles to maintain baseline system health.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a local attack vector (AV:L), low attack complexity (AC:L), low privilege requirements (PR:L), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), no integrity impact (I:N), but high availability impact (A:H) through resource exhaustion. The score appropriately captures that this is a local denial-of-service risk with no direct remote exploitability, and limited scope except for systems with STi audio hardware and active driver cycling.

Frequently asked questions