Executive brief
The Linux kernel's USB audio driver for Qualcomm devices has a flaw in stream initialization that can leave audio substreams in a locked state. When an audio stream enable request fails validation, the driver fails to properly reset its internal state, causing the substream to remain wedged and unavailable for future use until the device is disabled or disconnected. This can disrupt audio functionality on devices using Qualcomm USB audio offloading.
Technical details
The vulnerability exists in the ALSA (Advanced Linux Sound Architecture) USB audio driver's Qualcomm offloading module (sound/usb/qcom/qc_audio_offload.c). During stream enable handling, the driver sets the subs->opened flag before validating the service_interval parameter. If service interval validation fails with -EINVAL, the error path jumps to a response label without clearing the opened flag, leaving the substream in an invalid state (-EBUSY). An attacker or local process cannot directly exploit this; rather, it occurs when invalid service interval values are supplied during legitimate audio stream setup. The fix clears subs->opened on the enable error path before responding, ensuring proper state cleanup. The patch was merged upstream in June 2026 and backported to stable branches.
Affected products
- Linux Linux kernel Affected in versions with ALSA USB audio qcom support (introduced in earlier kernels, patched in stable branches from 2026-06-18 onwards)
Timeline
- 2026-06-18: disclosed: Patch committed to stable Linux kernel by Takashi Iwai
- 2026-06-18: patched: Fix merged into stable branches; backported commit 53c23d56b46b1ae51574d92110895086aead7ad7