CVE-2026-43480: ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
In the Linux kernel, the following vulnerability has been resolved:
ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
The acp3x5682init() function did not check the return value of clkget(), which could lead to dereferencing error pointers in rt5682clkenable().
Fix this by: 1. Changing clkget() to the device-managed devmclkget(). 2. Adding proper ISERR() checks for both clock acquisitions.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel ASoC AMD acp3x-rt5682-max9836 audio component are the relevant exposure scope. The issue occurs when required clock acquisition fails and the driver later dereferences the resulting error pointer.
What level of access is required to exploit it?
An attacker needs local access and low privileges, according to the CVSS vector. No user interaction is required; successful exploitation can cause a denial of service, with no confidentiality or integrity impact indicated.
How can I determine whether my kernel has been fixed?
The remediation changes clock handling to use devm_clk_get() and adds IS_ERR() validation for both clock acquisitions. The provided data does not identify affected or fixed kernel version numbers, so administrators should use the referenced stable fixes to determine whether their kernel includes the correction.