Executive brief
The Linux kernel's audio subsystem (ASoC) has a memory caching bug in the Sound Open Firmware (SOF) topology module. When audio devices suspend and resume, the firmware receives outdated DMA channel assignments, causing audio hardware conflicts and potential system crashes. This bug can disrupt audio functionality on suspend/resume cycles on affected systems.
Technical details
The vulnerability exists in the ASoC SOF ipc4-topology driver where copier widget IPC payload buffers are cached during initialization but not refreshed during suspend/resume cycles. When DMA streams are released and re-allocated with different stream tags during suspend/resume, the copier_data and dma_config_tlv structures are updated in the hardware configuration, but the cached ipc_config_data buffer is not rebuilt because sof_pcm_setup_connected_widgets is skipped on resume. This causes stale DMA channel assignments to be sent to the firmware. The fix refreshes the copier_data and dma_config_tlv portions in sof_ipc4_widget_setup before sending the IPC message, ensuring the payload reflects the current DMA state regardless of the caching behavior.
Affected products
- Linux Linux kernel Unfixed versions prior to patch
Timeline
- 2026-08-26: disclosed
- 2026-08-26: advisory: CVE-2026-80525