CVE-2026-93185: ASoC: rt700-sdw: always drain jack work on remove
ASoC: rt700-sdw: always drain jack work on remove
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
Which systems are relevant to this issue?
Systems using the Linux kernel rt700-sdw SoundWire codec driver are relevant. The problematic path involves the driver's jack detection and jack button delayed-work objects during device removal.
What sequence leads to the unsafe removal path?
A jack work item must have been queued while the device was initialized, then the SoundWire slave transitions to SDW_SLAVE_UNATTACHED, which clears hw_init, followed by driver removal. In that sequence, removal can skip draining work that was already queued.
How can administrators or developers identify the condition?
The supplied proof of concept caused DEBUG_OBJECTS to report an active timer/work object associated with rt700 jack work during removal. Reviewing traces for queued jack_detect_work or jack_btn_check_work followed by an unattached SoundWire status and remove operation can help identify the affected path.
What is the remediation behavior?
The corrected removal path cancels and drains the delayed jack work unconditionally, because the work objects are initialized during rt700_init(). The provided stable-kernel references contain the resolved changes.