Executive brief
A vulnerability was identified in the Linux kernel's Qualcomm audio driver (qdsp6) where the system failed to properly verify the type of audio 'widget' before accessing its memory. This could lead to incorrect memory access or system instability when handling virtual audio components that are not linked to the standard digital signal processing (DSP) graph. In practice, this could allow a local attacker to cause a system crash or potentially access restricted memory areas.
Technical details
A vulnerability in 'sound/soc/qcom/qdsp6/topology.c' within the Linux kernel's ASoC (ALSA System on Chip) subsystem arises from a lack of type checking for widgets during the unload process. Specifically, in 'audioreach_widget_unload', the code accessed 'dobj->private' and its members (like 'mod->container') before determining if the widget was a virtual widget or if the private data pointer was null. This can lead to a null pointer dereference or invalid memory access when processing virtual widgets not associated with a DSP graph, container, or module. The fix introduces a check for the widget ID and ensures the module pointer is valid before accessing its members.
Affected products
- Linux Linux Kernel 5.16 to 7.0.10
Timeline
- 2026-04-02: disclosed: Initial patch authored by Srinivas Kandagatla
- 2026-06-24: advisory: CVE-2026-53052 published in NVD
- 2026-05-23: patched: Fix committed to various stable kernel branches
References
- https://git.kernel.org/stable/c/1ac96689ce2984f4f6ef8892fcb65da377408421
- https://git.kernel.org/stable/c/296810e91f21a21794886c57f954495d8afd7f32
- https://git.kernel.org/stable/c/6d2491a585202a967ed91f30ec5960024f2536d0
- https://git.kernel.org/stable/c/8e8cd78b6000c9d19db249a5a68287158f288ef3
- https://git.kernel.org/stable/c/a1a24d4b8c9682f9b7a9138f636ff004c721aef1
- https://git.kernel.org/stable/c/d5bfdd28e0cdd45043ae6e0ac168a451d59283dc