CVE-2026-23190: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23190 is a memory leak vulnerability in the Linux kernel's ASoC (ALSA System on Chip) AMD ACP3X PDM DMA (Direct Memory Access) operations. The flaw causes allocated memory to not be properly released after its effective lifetime during PDM DMA operations. It was published on February 14, 2026, and affects Linux kernel versions from 5.8 through multiple stable branches up to 6.18.x and 6.19-rc variants. It carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local attack vector with high availability impact (Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), where the AMD ACP3X PDM DMA subsystem within the kernel's ASoC framework fails to free allocated memory buffers during DMA operations. An attacker with low-privileged local access can repeatedly trigger the vulnerable PDM DMA code path, causing memory to accumulate without being freed. No user interaction is required, and the attack complexity is low. Patches were committed to the stable kernel tree on March 18, 2026, across seven separate commits targeting different stable branches (Feedly, Kernel Patch).

Successful exploitation causes progressive memory exhaustion on the affected system, leading to degraded performance, service denial, or potential system crash. The impact is limited to availability — there is no confidentiality or integrity impact. Systems running AMD ACP3X hardware (typically AMD-based laptops and desktops using the PDM audio subsystem) are at risk, and repeated triggering of the leak can render the system unresponsive without requiring elevated privileges (Feedly).

Apply the patched Linux kernel versions released on March 18, 2026: 5.10.250+, 5.15.200+, 6.1.163+, 6.6.124+, 6.12.70+, and 6.18.10+. Distributions including Debian, Ubuntu, and Oracle Linux have issued their own kernel update advisories incorporating these fixes. As a temporary workaround, restrict local user access to systems with AMD ACP3X audio hardware, or limit use of the PDM audio subsystem until patching is complete. Monitor affected systems for signs of memory exhaustion or unexpected performance degradation (Feedly, Debian LTS Announce).