Executive brief
The Sound Open Firmware (SOF) audio driver in the Linux kernel contains a logic error in error handling during widget setup. If configuration operations fail, the code would incorrectly clean up resources twice, causing counter underflow and potential kernel instability. This impacts systems with Intel audio hardware using the SOF driver.
Technical details
The vulnerability is a double-decrement logic error in the sof_widget_setup_unlocked() function within sound/soc/sof/sof-audio.c. When tplg_ops->dai_config or widget_kcontrol_setup fail, the error path calls sof_widget_free_unlocked() to clean up, but then falls through to additional cleanup code that calls the same function a second time. This causes the widget's use_count to be decremented twice and core_put() to be invoked twice. The fix adds an early return statement after the first cleanup to prevent the fallthrough, ensuring use_count and core resource management occur exactly once. The issue affects widget initialization failures and could lead to reference count underflow.
Affected products
- Linux Linux kernel various (backported from upstream)
Timeline
- 2026-09-04: disclosed