The Linux kernel's ASoC meson driver contained a vulnerability (CVE-2026-93039) where meson_card_reallocate_links() used two consecutive krealloc() calls to grow arrays and only updated owner pointers after both succeeded. If the first krealloc() moved data and the second failed, card->dai_link pointed to freed memory, leading to a use-after-free and double free when meson_card_clean_references() was called on error. The fix commits the pointer and link count immediately after the first successful krealloc(), ensuring the pointer always references valid memory, preventing invalid dereferences and double frees.

Successful exploitation could cause use-after-free and double free conditions in kernel memory management, potentially leading to system crashes or arbitrary code execution with kernel privileges. The CVSS score of 7.4 indicates high severity with high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild.

A fix is available and has been applied in the Linux kernel to address this vulnerability. Users should update to the fixed kernel versions containing this patch. Since this is a kernel-level issue, applying the official kernel update is the recommended remediation.