CVE-2026-93187: ASoC: SOF: ipc4-topology: Return error for invalid number of formats
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc4-topology: Return error for invalid number of formats
When the number of input or output formats is zero, sofipc4widgetsetupcompsrc() and sofipc4widgetsetupcompasrc() print an error and jump to the cleanup label. At that point 'ret' is still 0, because the earlier sofipc4getaudiofmt() call succeeded, so the function returns success and the caller never finds out that the widget setup actually failed.
Set ret to -EINVAL before the goto so the error gets reported.
Affected Software
Event History
Frequently Asked Questions
What condition triggers the incorrect success result?
The issue occurs when an IPC4 SRC or ASRC widget has zero input formats or zero output formats. The setup function detects the invalid count but, after a prior audio-format lookup succeeds, can return success instead of an error.
How can I tell whether a system is affected?
Affected systems can exhibit a successful return from IPC4 SRC or ASRC widget setup even though the widget has no input or output formats and setup failed. Review the kernel source or applied stable fixes for the change that sets the return value to -EINVAL before the cleanup path.
What is the expected behavior after the fix?
Widget setup with an invalid zero input- or output-format count returns -EINVAL. This allows the caller to detect that SRC or ASRC widget setup failed rather than proceeding as if it succeeded.