Executive brief
A vulnerability exists in the Linux kernel's sound subsystem (ASoC) that can cause a system crash or unpredictable behavior when a sound card is disconnected while in use. This occurs because the system may attempt to access internal sound components after they have already been removed from memory. An attacker with local access could potentially exploit this to gain elevated privileges or cause a denial of service.
Technical details
A use-after-free vulnerability exists in `snd_soc_dapm_stream_event()` within the Linux kernel's ASoC core. The issue stems from a race condition during sound card unbinding: `snd_card_disconnect_sync()` releases PCM file descriptors, which can trigger `snd_soc_dapm_stream_stop()` and schedule new delayed work. Because this work is scheduled after the initial flush in `snd_soc_unbind_card()`, the workqueue may execute after `soc_remove_link_components()` has already freed the associated DAPM widgets. A local attacker can trigger this by unbinding a sound card driver while a PCM stream is open. The fix involves adding an explicit flush in `soc_cleanup_card_resources()` after the disconnect sync but before component removal.
Affected products
- Linux Linux Kernel 4.20 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9
Timeline
- 2026-03-25: patched: Patch committed to stable branches
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/231568afbc0cd25b8fb2a94ebf9738eabe1cf007
- https://git.kernel.org/stable/c/317a9298c54bb00319da73e5a7179f00e67fcbdf
- https://git.kernel.org/stable/c/3887e514978d28216246360b46a9cb534969eb5a
- https://git.kernel.org/stable/c/7d33e6140945482a07f8089ee86e13e02553ffdb
- https://git.kernel.org/stable/c/95bc5c225513fc3c4ce169563fb5e3929fbb938b
- https://git.kernel.org/stable/c/bf80a89da97285d9b877e0c6995e870d46b8025c
- https://git.kernel.org/stable/c/c054f0607c8bb1b1aa529bc109e4149298a1cccd