Executive brief
The Linux kernel's Sound on Firmware (SOF) audio driver contains a flaw in error validation that allows invalid audio format configurations to be incorrectly reported as successful. This could cause the audio system to proceed with invalid configurations, leading to audio playback failures or kernel instability when hardware is misconfigured.
Technical details
The vulnerability is an error handling bypass in the ASoC SOF ipc4-topology component. When sof_ipc4_widget_setup_comp_src() and sof_ipc4_widget_setup_comp_asrc() functions detect zero input or output formats (an invalid state), they print an error message and jump to cleanup code. However, the return value 'ret' remains 0 (success) because a prior sof_ipc4_get_audio_fmt() call had succeeded, causing the function to incorrectly report success to its caller. The fix sets ret = -EINVAL before the error path goto to properly signal failure. This affects Linux kernels with the ASoC SOF ipc4-topology implementation. No active exploitation has been reported.
Affected products
- Linux Linux kernel Various versions with ASoC SOF ipc4-topology support
Timeline
- 2026-09-17: disclosed
- 2026-06-29: patched