UBUNTU-CVE-2026-80911: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked() If either tplgops->daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked() would be called twice, similarly the coreput would be invoked twice as well. Since the usecount and coreput() is handled within the widgetfree function we need to return without falling through the pipewidgetfree label. The fixes tag is picked to the last change around this part of the code which is adequately old enough for backporting purposes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which Ubuntu kernel package families are identified as affected?
The affected package families listed are linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.
What condition triggers the flawed cleanup path?
The issue occurs when either tplg_ops->dai_config or widget_kcontrol_setup fails during SOF audio widget setup. The resulting error handling can decrement the widget use_count twice and invoke core_put() twice.