Executive brief
A vulnerability in the Linux kernel's audio subsystem could cause a system crash (kernel oops) under specific hardware initialization failures. This occurs when the system attempts to clean up audio device functions that were never fully registered, such as when required firmware is missing. While primarily an availability issue, it can lead to unexpected system reboots or instability during hardware configuration.
Technical details
A NULL pointer dereference exists in the sdca_dev_unregister_functions() function within the Soundwire Discovered Class Audio (SDCA) implementation of the Linux kernel. The vulnerability is triggered when the function iterates over SDCA function descriptors and attempts to unregister them without verifying if the function device pointers are NULL. This condition typically occurs during error handling paths, such as when a driver probe fails due to missing firmware or during races with probe deferral. An attacker with sufficient privileges to trigger device registration/unregistration or a system encountering specific hardware errors could cause a kernel oops. The fix introduces NULL guards in the unregistration path and ensures proper rollback during registration failures.
Affected products
- Linux Linux 6.19 to 7.0.12
Timeline
- 2026-06-11: disclosed: Initial patch submitted by Kean Ren
- 2026-07-01: advisory: CVE published by NVD