Security readout for executives and security teams
Plain-English summary
A memory-lifecycle error in Linux’s Qualcomm q6apm audio driver can leave the sound subsystem referencing already-freed data during device or driver removal. The observed result is a kernel use-after-free. Exploitation requires local, low-privileged access according to the supplied CVSS assessment; potential impact is serious, but exposure is limited to systems using the affected driver path.
Executive priority
Prioritize verification and patching for endpoints or appliances with Qualcomm audio hardware, particularly multi-user or locally accessible systems. This is not supported as an internet-wide emergency, but kernel memory corruption justifies prompt remediation. Systems without the q6apm path are unlikely to share this specific exposure; document that conclusion rather than assuming all Linux hosts are affected.
Technical view
Managed allocation of both the ASoC component and dynamically created DAIs permits the DAIs to be freed before component removal. A later reference in snd_soc_del_component_unlocked causes a slab use-after-free. KASAN demonstrated an eight-byte read during q6apm/APR teardown. The stable fix changes component registration to unmanaged lifetime handling, preserving DAI pointers until component removal completes.
Likely exposure
Likely exposure is concentrated in Linux devices using Qualcomm q6apm ASoC audio with dynamically loaded topology. The supplied affected-version data is ambiguous and includes release numbers alongside commit identifiers, so exact exposure cannot be reliably derived from it alone. Confirm kernel build, driver presence, hardware use, and distributor backport status.
Exploitation context
The supplied CVSS 3.1 score is 7.8 with local access, low complexity, low privileges, and no user interaction. CISA KEV status is false, and the bundle provides no evidence of active exploitation or a public exploit. The trace proves a use-after-free read and possible instability; practical confidentiality or integrity exploitation is not demonstrated.
Researcher notes
The observed path runs through devres cleanup, APR device removal, and snd_soc component unregistering. The fix addresses object-lifetime ordering rather than adding input validation. Researchers should distinguish the demonstrated KASAN read from the CVSS-scored potential for confidentiality, integrity, and availability impact. The source bundle does not establish reliable affected release boundaries or exploitability beyond local prerequisites.
Mitigation direction
- Inventory Linux systems using Qualcomm q6apm audio and compare kernel builds with the CVE record and vendor advisories.
- Apply a vendor-supported kernel containing the branch-appropriate stable fix; follow vendor reboot guidance.
- If patching is delayed, restrict untrusted local access to affected systems.
- Monitor affected hosts for kernel memory-safety reports, audio failures, or unexpected device teardown events.
Validation and detection
- Confirm the running kernel includes a cited stable fix or a vendor-documented backport.
- Reboot after updating when required, then verify the corrected kernel is running.
- Check kernel logs for KASAN reports, use-after-free messages, warnings, and q6apm teardown failures.
- Run vendor-approved regression testing covering audio topology initialization and device or driver removal.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31587 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/110769a9aa51135ac7ce479a47dfb41924f37664CVE reference, Linux
- https://git.kernel.org/stable/c/887632163b546a8944b46ef465f1d74e838b727aCVE reference, Linux
- https://git.kernel.org/stable/c/b7412ed789ffb1e59c8d6f5ab6a6a718963c85e2CVE reference, Linux
- https://git.kernel.org/stable/c/30383b7780ffa140bc124de5b66cae7c84133dbbCVE reference, Linux
- https://git.kernel.org/stable/c/f7b790531cdad3b2075ab937aa06d7b802403be4CVE reference, Linux
- https://git.kernel.org/stable/c/a561a55b79a9c55f0443377f2d4dcf6149d057afCVE reference, Linux
- https://git.kernel.org/stable/c/6ec1235fc941dac6c011b30ee01d9220ff87e0cdCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.