CVE-2026-80911: ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked()
If either tplgops->daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked() would be called twice, similarly the coreput would be invoked twice as well.
Since the usecount and coreput() is handled within the widgetfree function we need to return without falling through the pipewidgetfree label.
The fixes tag is picked to the last change around this part of the code which is adequately old enough for backporting purposes.
Affected Software
Event History
Frequently Asked Questions
What conditions must occur for the faulty cleanup path to be reached?
Widget setup must fail in either tplg_ops->dai_config or widget_kcontrol_setup. The issue occurs during cleanup after one of those setup failures, when the widget use_count and core reference are decremented twice.
What is the practical impact of the error-path bug?
The affected error path can double-decrement a widget's use_count and invoke core_put() twice. The provided information does not specify an externally reachable attack vector, privilege requirement, or resulting security impact.
Which Linux kernel versions are affected or fixed?
The provided data does not identify affected or fixed kernel version numbers. It provides stable-kernel commit references for the resolution, and notes that the relevant code change is old enough to support backporting.