CVE-2026-53348: ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SDCA: fix NULL pointer dereference in sdcadevunregisterfunctions
sdcadevunregisterfunctions() iterates over all SDCA function descriptors and calls sdcadevunregister() on each funcdev without checking for NULL. When a function registration has failed partway through, or the device cleanup races with probe deferral, funcdev entries may be NULL, leading to a kernel oops:
BUG: kernel NULL pointer dereference, address: 0000000000000040 RIP: 0010:devicedel+0x1e/0x3e0 Call Trace: sdcadevunregisterfunctions+0x37/0x60 [sndsocsdca] releasenodes+0x35/0xb0 devresreleaseall+0x90/0x100 deviceunbindcleanup+0xe/0x80 devicereleasedriverinternal+0x1c1/0x200 busremovedevice+0xc6/0x130 devicedel+0x161/0x3e0 deviceunregister+0x17/0x60 sdwdeleteslave+0xb6/0xd0 [soundwirebus] sdwbusmasterdelete+0x1e/0x50 [soundwirebus] ... sofprobework+0x19/0x30 [sndsof]
This was observed on a Lenovo ThinkPad X1 Carbon G14 (Panther Lake) with the SOF audio driver probe failing due to missing Panther Lake firmware, causing the subsequent cleanup of SoundWire devices to trigger the crash.
Fix this with three changes:
1) Add a NULL guard in sdcadevunregister() so that callers do not need to pre-validate the pointer (defense in depth).
2) In sdcadevunregisterfunctions(), skip NULL funcdev entries and clear funcdev to NULL after unregistration, making the function idempotent and safe against double-invocation.
3) In sdcadevregisterfunctions(), roll back all previously registered functions when a later one fails, so the function array is never left in a partially-populated state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In sdca_dev_unregister(), add a NULL guard so callers do not trigger a NULL pointer dereference during unregistration.
Linux kernel (ALSA SoC: SDCA) sdca_dev_unregister() NULL guard = pre-validate pointer before dereference (add NULL guard so callers do not crash) - Configuration
In sdca_dev_unregister_functions(), skip NULL func_dev entries while iterating so device cleanup cannot dereference a NULL function descriptor.
Linux kernel (ALSA SoC: SDCA) sdca_dev_unregister_functions() NULL func_dev handling = skip NULL func_dev entries - Configuration
In sdca_dev_register_functions(), if registration fails partway through, roll back all previously registered functions to avoid leaving the function array in a partially-populated state.
Linux kernel (ALSA SoC: SDCA) sdca_dev_register_functions() rollback behavior = roll back all previously registered functions if a later registration fails
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53348?
The severity of CVE-2026-53348 is rated at 37.
What is CVE-2026-53348?
CVE-2026-53348 is a vulnerability in the Linux kernel that involves a NULL pointer dereference in the sdca_dev_unregister_functions.
What causes the CVE-2026-53348 vulnerability?
CVE-2026-53348 is caused by a lack of NULL checks when iterating over SDCA function descriptors in the sdca_dev_unregister_functions.
How do I fix CVE-2026-53348?
To fix CVE-2026-53348, update the Linux kernel to a version that includes the patch addressing the NULL pointer dereference.
Who is affected by CVE-2026-53348?
Users running vulnerable versions of the Linux kernel that handle SDCA function descriptors may be affected by CVE-2026-53348.