Executive brief
A vulnerability has been identified in the Linux kernel's Intel audio driver that could lead to system instability or unauthorized access. The issue occurs when the system shuts down an audio stream while it is still processing background tasks, potentially causing the system to crash or behave unpredictably. This could allow a local user with basic access to compromise the integrity or availability of the system.
Technical details
A race condition exists in the Linux kernel's ASoC Intel AVS driver within 'sound/soc/intel/avs/pcm.c'. The function 'avs_dai_fe_shutdown()' handles the shutdown of HOST HDAudio streams and frees the Digital Audio Interface (DAI) private context. However, if 'period-elapsed' work is still servicing interrupts (IRQs) during this process, it may attempt to access the already-freed context, leading to a slab-use-after-free. An attacker with local access could potentially exploit this to cause a kernel panic or achieve local privilege escalation. The fix involves adding 'disable_work_sync()' to ensure background tasks are completed before the context is released.
Affected products
- Linux Linux Kernel 6.11.9 to 6.12, 6.12.58, 6.17.8, 6.18
Timeline
- 2025-12-09: disclosed
- 2025-12-09: advisory