CVE-2026-98055: ASoC: Intel: avs: Clean up the bus when fetching ML caps fails
In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel: avs: Clean up the bus when fetching ML caps fails
sndhdacextbusgetmlcapabilities() may fail and its return code shall be checked and accounted for. Address the issue by updating the error-path for avspciprobe().
At the same time, if the function in question succeeds but the next part of avspciprobe() fails, the hlink list shall be cleaned up before leaving the scope.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Under what condition is the affected error path reached?
It is reached when snd_hdac_ext_bus_get_ml_capabilities() fails during avs_pci_probe(). A related cleanup issue also occurs if capability retrieval succeeds but a later portion of avs_pci_probe() fails.
What state is left uncleared on these probe failures?
The bus must be cleaned up when ML capability retrieval fails. If a subsequent probe step fails after successful capability retrieval, the hlink list must also be cleaned up before returning.
Is a fix available?
Yes. The provided references point to three stable Linux kernel commits containing the resolution. The supplied data does not identify the kernel versions that include those commits.