Executive brief
A vulnerability in the Linux kernel's audio subsystem for Qualcomm chipsets can cause a system crash. This occurs when the audio digital signal processor (ADSP) stops and starts, leading to an improper shutdown sequence. An attacker with local access could potentially exploit this to cause a denial-of-service by crashing the operating system.
Technical details
A NULL pointer dereference exists in the ASoC (ALSA SoC) layer of the Linux kernel, specifically within the Qualcomm QDSP6 Audio Process Manager (q6apm). During ADSP stop/start cycles, the 'q6apm-audio' remove callback unloads topology and removes PCM runtimes before the q6apm DAI components are properly detached. This results in runtime data structures (RTDs) being deleted while components are still linked to the sound card, leading to a crash during the subsequent rebind or teardown. The fix involves reordering the removal sequence to ensure child components are removed before the parent q6apm component.
Affected products
- Linux Linux Kernel 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9
Timeline
- 2026-02-27: patched: Initial patch submitted by Qualcomm OSS authors
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0da170b9e600da6930cfb8352e4cc036db3b6159
- https://git.kernel.org/stable/c/22b05abb17e3c6ef45035141fe3d26f815ff9d30
- https://git.kernel.org/stable/c/897f32cab7945f4662a50b3841ba31c6c3204876
- https://git.kernel.org/stable/c/94bda21adb2a51f69366b847b4d80dfe50bd9fb9
- https://git.kernel.org/stable/c/a8e9cab16771b15160465783507496dc83742d8e
- https://git.kernel.org/stable/c/d6db827b430bdcca3976cebca7bd69cca03cde2c