In the Linux kernel, the following vulnerability has been resolved:
ASoC: soc-core: flush delayed work before removing DAIs and widgets
When a sound card is unbound while a PCM stream is open, a
use-after-free can occur in snd_soc_dapm_stream_event(), called from
the close_delayed_work workqueue handler.
During unbind, snd_soc_unbind_card() flushes delayed work and then
calls soc_cleanup_card_resources(). Inside cleanup,
snd_card_disconnect_sync() releases all PCM file descriptors, and
the resulting PCM close path can call snd_soc_dapm_stream_stop()
which schedules new delayed work with a pmdown_time timer delay.
Since this happens after the flush in snd_soc_unbind_card(), the
new work is not caught. soc_remove_link_components() then frees
DAPM widgets before this work fires, leading to the use-after-free.
The existing flush in soc_free_pcm_runtime() also cannot help as it
runs after soc_remove_link_components() has already freed the widgets.
Add a flush in soc_cleanup_card_resources() after
snd_card_disconnect_sync() (after which no new PCM closes can
schedule further delayed work) and before soc_remove_link_dais()
and soc_remove_link_components() (which tear down the structures the
delayed work accesses).
References
Configurations
Configuration 1 (hide)
|
History
21 May 2026, 16:45
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
|
| First Time |
Linux linux Kernel
Linux |
|
| References | () https://git.kernel.org/stable/c/231568afbc0cd25b8fb2a94ebf9738eabe1cf007 - Patch | |
| References | () https://git.kernel.org/stable/c/317a9298c54bb00319da73e5a7179f00e67fcbdf - Patch | |
| References | () https://git.kernel.org/stable/c/3887e514978d28216246360b46a9cb534969eb5a - Patch | |
| References | () https://git.kernel.org/stable/c/7d33e6140945482a07f8089ee86e13e02553ffdb - Patch | |
| References | () https://git.kernel.org/stable/c/95bc5c225513fc3c4ce169563fb5e3929fbb938b - Patch | |
| References | () https://git.kernel.org/stable/c/bf80a89da97285d9b877e0c6995e870d46b8025c - Patch | |
| References | () https://git.kernel.org/stable/c/c054f0607c8bb1b1aa529bc109e4149298a1cccd - Patch | |
| References | () https://git.kernel.org/stable/c/eab71e11ce2447c1e01809cbc11eab4234cf8dc8 - Patch | |
| CWE | CWE-416 |
11 May 2026, 08:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.3 |
08 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-08 15:16
Updated : 2026-05-21 16:45
NVD link : CVE-2026-43459
Mitre link : CVE-2026-43459
CVE.ORG link : CVE-2026-43459
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free