Executive brief
The Linux kernel's ASoC rt700-sdw audio driver has a lifecycle management issue where jack detection work items may not be properly canceled during device removal. If the SoundWire slave detaches while jack work is pending, the remove path skips cleanup, potentially leaving active work objects after the driver is unloaded. This could lead to system instability or kernel panics.
Technical details
The vulnerability is a work queue lifecycle issue in the rt700-sdw SoundWire audio codec driver. The rt700_sdw_remove() function only drains jack_detect_work and jack_btn_check_work when the rt700->hw_init flag is true, but this flag is cleared by rt700_update_status() when the SoundWire slave transitions to UNATTACHED state—even if jack work has already been queued by rt700_interrupt_callback() or rt700_jack_init(). An attacker or malicious device could trigger an UNATTACHED status update after queuing jack work but before remove executes, causing the remove path to skip the cancel operation. The fix is to unconditionally drain these delayed work objects during remove, binding their lifecycle to the codec's private data lifetime rather than a mutable hardware state bit. The issue was validated using QEMU to simulate the race condition, with DEBUG_OBJECTS confirming an active timer/work object remained after remove.
Affected products
- Linux Linux kernel affected versions not specified
Timeline
- 2026-09-17: disclosed