CVE-2026-80911: ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions must occur for the faulty cleanup path to be reached?
Widget setup must fail in either tplg_ops->dai_config or widget_kcontrol_setup. The issue occurs during cleanup after one of those setup failures, when the widget use_count and core reference are decremented twice.
What is the practical impact of the error-path bug?
The affected error path can double-decrement a widget's use_count and invoke core_put() twice. The provided information does not specify an externally reachable attack vector, privilege requirement, or resulting security impact.
Which Linux kernel versions are affected or fixed?
The provided data does not identify affected or fixed kernel version numbers. It provides stable-kernel commit references for the resolution, and notes that the relevant code change is old enough to support backporting.