CVE-2026-98092

Executive Summary

CVE-2026-98092 is a memory leak in the Linux kernel ALSA System-on-Chip (ASoC) AMD Audio Co-Processor 6.x (ACP6x) Yellow Carp (YC) driver. The function acp6x_pdm_dma_close() fails to release the buffer that was allocated and stored in runtime->private_data by acp6x_pdm_dma_open(), and the resolution adds the missing kfree. The flaw is a local, kernel-resident resource-exhaustion issue affecting systems that expose the AMD ACP6x PDM DMA path — principally AMD Ryzen-based platforms with the corresponding audio hardware — and successful abuse results in unbounded kernel heap growth rather than code execution or privilege escalation.

Technical Analysis

The vulnerable component is the ASoC machine/ platform driver for AMD ACP6x audio, specifically the Pulse Density Modulation (PDM) DMA capture path used on "Yellow Carp" class platforms. The lifecycle of this object is asymmetric:

• On open (acp6x_pdm_dma_open()), a buffer is allocated and its address is stored in runtime->private_data. The ALSA snd_pcm_runtime structure is per-substream and persists across open/close cycles managed by the PCM framework.
• On close (acp6x_pdm_dma_close()), the driver tears down DMA activity but never calls kfree() on runtime->private_data. The pointer is therefore overwritten or lost on the next open without the backing allocation being returned to the allocator.

The result is a classic missing-release memory leak, mapped to CWE-401. Each open/close cycle of the PDM DMA stream — if the runtime object is recreated per cycle, which is the normal behavior when an ALSA PCM substream is opened and closed — leaks a kernel-heap object of the size of the PDM buffer. Because the allocation size is fixed by the driver rather than attacker-controlled, the leak rate is deterministic and proportional to the number of open/close cycles an actor can induce.

Root cause characteristics:

1. Ownership asymmetry — allocation and deallocation are split across two functions with no complementary free path.
2. No error-path recovery — because kfree is absent altogether, the leak occurs on the normal, successful close path, not only on an error path. This makes it trivially reachable under ordinary operation.
3. Kernel-resident impact — leaked objects remain accounted to the slab allocator and are never reclaimable, so pressure accumulates monotonically.

Attack surface: The trigger surface is the ALSA PCM device node associated with the ACP6x PDM DMA stream, reachable from user space by any process with permission to open the relevant /dev/snd/pcm* device (typically any user in the audio group, or a session-local user on desktop/embedded configurations). It is not a network-reachable surface, which is why this CVE carries no NVD CVSS vector and is not listed in CISA KEV.

The description does not disclose the exact allocation size, the slab cache involved, the specific /dev and ALSA card indices, or the module name beyond snd-soc-amd-acp-family drivers. Those details are not asserted here.

Exploitation Scenarios

The attack chain below is described at the vulnerability-class level. No public PoC, exploit code, or Nuclei template exists for this CVE; the chain is inferred from the missing-release memory-leak class and the ALSA PCM lifecycle.

1. Reconnaissance / target identification. An attacker who already holds a local account on the target (or reaches it via a separate initial-access vector) determines whether the AMD ACP6x PDM audio path is present and usable. This is established by enumerating ALSA PCM devices and identifying the capture/PDM control node exposed by the ACP6x driver. Systems without AMD ACP6x/Yellow Carp audio hardware are not affected.

2. Triggering the flaw class. The attacker repeatedly opens and closes the PDM DMA PCM stream. Each successful open allocates the runtime->private_data buffer, and each corresponding close in the vulnerable function returns DMA resources but omits kfree. The absence of the free is unconditional, so every cycle leaks.

3. Payload / execution method. No payload is required. The "weapon" is iteration: a simple loop of open/close operations on the affected PCM node. No crafted audio data, no malformed buffer, and no size manipulation is needed — the leak is resident in the code path itself. Because the description names no controllable parameters, no parameter-level manipulation is claimed here.

4. Post-exploitation impact. Repeated cycles steadily consume kernel memory that is never reclaimed. Over time this drives memory pressure on the host, degrading audio and other kernel allocations, potentially provoking the OOM killer and, in the worst case, causing system instability or denial of service. Because the primitive is a leak rather than a write, there is no corruption, no code execution, and no direct privilege escalation. The practical ceiling is availability impact on the local system.

Note: No public PoC available; attack chain is inferred from the vulnerability class. There is no evidence of exploit-in-the-wild activity, and the CVE is not in CISA KEV.

Impact Assessment

• Confidentiality: None. The leak does not expose the contents of the buffer to any principal and provides no information-disclosure primitive.
• Integrity: None. No memory corruption, no out-of-bounds write, no control over freed-object reuse.
• Availability: The primary impact. Cumulative, unreclaimable kernel-heap consumption can exhaust memory over a sustained period of repeated open/close cycles, leading to degraded performance, allocation failures, or system-level denial of service.
• Privilege required: Local access to an ALSA PCM device associated with the ACP6x PDM path. This is a low-privilege, local precondition, not remote.
• Blast radius: Constrained to AMD ACP6x / Yellow Carp audio platforms running the affected ASoC driver. Mixed fleets are only affected on matching hardware.
• CVSS: No score or vector has been assigned by NVD (N/A); this report does not substitute a score from any third-party source. EPSS has not been scored by FIRST.org. CISA KEV status: not listed.
• Overall: A low-to-moderate severity, local, resource-exhaustion defect. It is best characterized as a reliability and hardening issue rather than a high-priority exploitable vulnerability, though its unconditional normal-path reachability makes it reliably triggered by any local actor.

Detection Guidance

Detection focuses on kernel telemetry and on anomalies in ALSA device access patterns, since there is no network signature.

Sigma Rule

title: Repeated ALSA PCM Open/Close on AMD ACP6x PDM Device (Memory Leak Trigger)
id: 6f8c1c2a-1d2b-4b7a-9f21-8a3c0d5e4b31
status: experimental
description: Detects rapid, repeated open/close activity against ALSA PCM capture devices consistent with triggering the acp6x_pdm_dma_close memory leak (CVE-2026-98092).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98092
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_syscall:
    type: 'SYSCALL'
    syscall|contains:
      - 'openat'
      - 'open'
  selection_device:
    name|contains: '/dev/snd/pcm'
  condition: selection_syscall and selection_device
  timeframe: 60s
  # Correlate: alert when the same PID opens the same /dev/snd/pcm node
  # more than 50 times within the timeframe.
level: low
tags:
  - attack.t1499
  - cve.2026.98092

YARA Rule

rule CVE_2026_98092_ACP6X_PDM_LEAK_MARKER
{
    meta:
        description = "Heuristic marker rule for Linux kernel builds containing the vulnerable acp6x_pdm_dma_close path (CVE-2026-98092)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98092"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "low"

    strings:
        $s1 = "acp6x_pdm_dma_close" ascii
        $s2 = "acp6x_pdm_dma_open" ascii
        $s3 = "runtime->private_data" ascii

    condition:
        // Flag kernel images or modules that reference the open/close pair.
        // Analyst must confirm the absence of an associated kfree in the
        // close path before treating as vulnerable.
        uint32(0) == 0x464c457f and any of ($s1, $s2) and $s3
}

Suricata IDS Rule

No network-reachable surface exists for this vulnerability; no meaningful network IDS signature can be authored. A placeholder rule documenting the absence of a signature is provided for completeness:

# CVE-2026-98092 is a local kernel memory leak (ASoC AMD ACP6x PDM DMA).
# No network signature is applicable. Rule intentionally disabled.
alert ip any any -> any any (msg:"CVE-2026-98092 no network signature (local kernel memory leak)"; sid:202698092; rev:1; classtype:policy-violation; enabled:no;)

Elastic Detection

sequence by process.entity_id with maxspan=60s
  [ process where event.type == "start" and process.name != null ]
  [ file where event.action == "open" and file.path wildcard "/dev/snd/pcm*" ]

Correlate the above with high-frequency repetition: alert when a single process.entity_id generates more than 50 file where file.path wildcard "/dev/snd/pcm*" events within a 60-second window, which is consistent with looped open/close cycles that leak runtime->private_data.

Splunk SPL Query

index=linux sourcetype=auditd OR sourcetype=syslog
| search "/dev/snd/pcm"
| stats count, values(action) AS actions BY host, process_id, user
| where count > 50
| sort - count
| table host, process_id, user, count, actions

For hosts running a kernel audit rule on openat scoped to /dev/snd/, this query surfaces a single process repeatedly opening the same ALSA PCM node — the behavioral signature of the leak trigger.

Wazuh OSSEC Rule

<group name="linux,cve-2026-98092,alsa,">
  <rule id="980920" level="3">
    <decoded_as>json</decoded_as>
    <field name="audit.key">alsa_pcm_open</field>
    <field name="audit.name">/dev/snd/pcm</field>
    <description>CVE-2026-98092: ALSA PCM device opened (AMD ACP6x PDM leak correlation)</description>
  </rule>

  <rule id="980921" level="7" frequency="50" timeframe="60">
    <if_matched_sid>980920</if_matched_sid>
    <same_field>audit.pid</same_field>
    <description>CVE-2026-98092: repeated ALSA PCM open/close by same PID - possible acp6x_pdm_dma_close memory leak abuse</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, no vendor fix reference is published, and no affected-version list is available. The CNA description states only that the upstream resolution is to add the missing kfree in acp6x_pdm_dma_close(). Until a vendor-issued patch is distributed and confirmed, treat affected systems as unpatched and apply mitigations below.

1. Immediate mitigations

   • Restrict audio device access. Limit membership of the audio group and permissions on /dev/snd/pcm* so that only trusted, non-hostile local users can open the ACP6x PDM stream. Removing the ability to invoke open/close cycles removes the trigger.
   • Constrain untrusted local execution. This is a local precondition vulnerability; endpoint hardening that prevents unprivileged or attacker-controlled processes from running on affected hosts eliminates the exposure.
   • Monitor kernel memory headroom. Alert on sustained growth in slab usage and on rising OOM events on AMD ACP6x hosts, which may indicate active leak triggering.
   • Blacklist the module where audio is non-essential. On servers that do not require the AMD ACP6x audio path, disabling or not loading the relevant ASoC module removes the attack surface entirely.

2. Patch / upgrade steps

   • Track Linux kernel stable releases and vendor advisories (Red Hat, SUSE, Ubuntu, Debian). The kernel change is small and known relative to the open/close pair; apply the kernel version whose changelog includes the acp6x_pdm_dma_close() kfree fix once it is published.
   • Reboot into the patched kernel — memory-leak fixes in kernel modules require the new image to be loaded to take effect.
   • Verify after upgrade that the running kernel corresponds to the fixed build before closing out the finding.

3. Long-term hardening

   • Adopt a disciplined kernel patch cadence for local-DoS class fixes, since they are individually low severity but accumulate reliability risk.
   • Include slab-accounting and OOM-pressure telemetry in baseline monitoring for embedded and desktop AMD audio fleets.
   • Apply least privilege to device-node access as a default posture control across hardware/driver paths, not only for this CVE.

References

• NVD — CVE-2026-98092: https://nvd.nist.gov/vuln/detail/CVE-2026-98092
• Linux kernel ASoC subsystem (sound/soc) source and stable release changelogs — the authoritative location for the acp6x_pdm_dma_close() fix
• CWE-401, Missing Release of Memory after Effective Lifetime: https://cwe.mitre.org/data/definitions/401.html
• FIRST.org EPSS — no score currently published for CVE-2026-98092 (status confirmed, not fabricated)
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-98092 is not listed; no threat-actor campaign or exploit-in-the-wild evidence is associated with this CVE at the time of writing