CVE-2026-43459

In the Linux kernel, the following vulnerability has been resolved:

ASoC: soc-core: flush delayed work before removing DAIs and widgets

When a sound card is unbound while a PCM stream is open, a use-after-free can occur in snd_soc_dapm_stream_event(), called from the close_delayed_work workqueue handler.

During unbind, snd_soc_unbind_card() flushes delayed work and then calls soc_cleanup_card_resources(). Inside cleanup, snd_card_disconnect_sync() releases all PCM file descriptors, and the resulting PCM close path can call snd_soc_dapm_stream_stop() which schedules new delayed work with a pmdown_time timer delay. Since this happens after the flush in snd_soc_unbind_card(), the new work is not caught. soc_remove_link_components() then frees DAPM widgets before this work fires, leading to the use-after-free.

The existing flush in soc_free_pcm_runtime() also cannot help as it runs after soc_remove_link_components() has already freed the widgets.

Add a flush in soc_cleanup_card_resources() after snd_card_disconnect_sync() (after which no new PCM closes can schedule further delayed work) and before soc_remove_link_dais() and soc_remove_link_components() (which tear down the structures the delayed work accesses).

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/231568afbc0cd25b8fb2a94ebf9738eabe1cf007
• https://git.kernel.org/stable/c/317a9298c54bb00319da73e5a7179f00e67fcbdf
• https://git.kernel.org/stable/c/3887e514978d28216246360b46a9cb534969eb5a
• https://git.kernel.org/stable/c/7d33e6140945482a07f8089ee86e13e02553ffdb
• https://git.kernel.org/stable/c/95bc5c225513fc3c4ce169563fb5e3929fbb938b
• https://git.kernel.org/stable/c/bf80a89da97285d9b877e0c6995e870d46b8025c
• https://git.kernel.org/stable/c/c054f0607c8bb1b1aa529bc109e4149298a1cccd
• https://git.kernel.org/stable/c/eab71e11ce2447c1e01809cbc11eab4234cf8dc8