CVE-2026-45875

What it actually does

This is a local availability flaw in the Linux kernel Arizona MFD/audio-codec driver path for WM5102 devices. If wm5102_clear_write_sequencer() fails, the error path returns before running the cleanup logic that disables/releases regulator resources. Repeatedly reaching this failure path can leave regulators enabled, causing a kernel-managed resource leak and potentially degrading system stability, power management, or device availability. The CVSS vector indicates local access with low complexity and low privileges, no user interaction, no confidentiality or integrity impact, and high availability impact.

Why it matters to the business

Systems using affected Linux kernels with Arizona/WM5102 audio-codec hardware or enabled drivers may experience instability, degraded battery/power behavior, audio subsystem failures, or denial of service if a local user or process can repeatedly trigger the failing driver path. Exploitation likelihood is currently low based on the very low EPSS score, lack of known public exploit maturity, and no CISA KEV listing, but kernel availability flaws still matter for shared systems, embedded devices, mobile/IoT platforms, and appliances where rebooting or physical servicing is costly.

How an attack unfolds

An attacker first needs local access to a system running a vulnerable Linux kernel with the relevant Arizona/WM5102 driver path present and reachable. The attacker then exercises interfaces that cause the WM5102 write-sequencer cleanup routine to run and fail, such as audio-codec initialization, reset, suspend/resume, or driver/device state transitions depending on the platform. Because the vulnerable error path returns immediately instead of jumping to the cleanup label, regulator resources are left enabled. By repeatedly triggering the path, the attacker can accumulate leaked regulator state, potentially exhausting resources, destabilizing the device driver, increasing power draw, breaking audio hardware behavior, or contributing to a local denial of service. There is no indication from the provided data that this enables code execution, privilege escalation, data theft, or remote exploitation.

How to fix it

Update to a Linux kernel build that includes the upstream fix changing the wm5102_clear_write_sequencer() failure path to jump to the cleanup sequence instead of returning directly. If using a distribution kernel, apply the vendor security/maintenance update when available rather than cherry-picking manually. If maintaining a custom kernel, backport the patch for the Arizona MFD driver that routes the failure path through the err_reset cleanup label. Where immediate patching is not possible, reduce exposure by disabling unused Arizona/WM5102 driver support, preventing untrusted local users from accessing audio/device-management interfaces, restricting module load/unload permissions, and limiting local shell access on systems where this hardware is present.

How to confirm the fix worked

Confirm the running kernel package or custom build contains the Arizona MFD cleanup fix for wm5102_clear_write_sequencer(). For source-based validation, inspect the relevant driver code and verify that errors from wm5102_clear_write_sequencer() branch to the cleanup/error-reset path rather than returning directly. For binary or fleet validation, inventory kernels and compare them against distribution advisories or upstream stable kernel releases that include the fix. On affected hardware, perform regression testing around audio codec initialization, suspend/resume, reset, and error handling while monitoring regulator state, kernel logs, and system stability to ensure resources are cleaned up after failure conditions.

Typical attack path

1. Obtain local access to a Linux system where the affected kernel driver is present and the Arizona/WM5102 hardware or driver path is enabled.
2. Identify accessible user-space controls that can influence the audio codec or device lifecycle, such as audio subsystem operations, power-management transitions, or driver reset/reprobe behavior.
3. Trigger a condition where wm5102_clear_write_sequencer() returns an error.
4. Repeat the triggering action so the vulnerable error path leaks regulator resources instead of performing cleanup.
5. Cause degraded device behavior, excessive resource/power consumption, kernel warnings, driver malfunction, or denial of service requiring service restart, module reload, or reboot.

How to detect it

Look for evidence of repeated failures in the Arizona/WM5102 audio-codec driver, regulator cleanup problems, abnormal power-management behavior, or local processes repeatedly exercising audio/device reset paths. Useful log sources include kernel logs from dmesg or journald, syslog/kern.log, auditd process-execution records, eBPF/EDR telemetry for module and device interactions, and power-management or watchdog logs on embedded systems. Investigate repeated messages involving Arizona, WM5102, regulator enable/disable failures, write-sequencer failures, audio codec resets, suspend/resume loops, or unexpected module reloads. Correlate these events with local user sessions, scripts, stress tools, audio-control utilities, module load/unload commands, and device reset/reprobe activity. There are no public exploitation artifacts indicated in the provided data, so detection should focus on behavioral evidence of repeated triggering and resulting driver/resource instability rather than a known exploit signature.

• wm5102_clear_write_sequencer
• drivers/mfd/arizona
• drivers/mfd/arizona-core.c
• wm5102
• WM5102
• arizona
• Arizona
• regulator resource leak
• Failed to enable regulator
• Failed to disable regulator
• regulator_enable
• regulator_disable
• snd-soc-wm5102
• snd_soc_wm5102
• mfd_arizona
• modprobe snd-soc-wm5102
• modprobe arizona
• rmmod snd-soc-wm5102
• /sys/bus/platform/drivers/arizona
• /sys/bus/spi/drivers/arizona
• /sys/bus/i2c/drivers/arizona

What your security team should do

• Prioritize patching Linux systems that use Arizona/WM5102 audio-codec hardware, embedded Linux builds, mobile/IoT devices, appliances, and systems where untrusted local users can run code.
• Track vendor kernel advisories and stable kernel updates for the fix; no fixed version was provided in the input, so rely on distribution or upstream kernel patch status.
• Inventory systems for enabled Arizona/WM5102 driver support, especially custom kernels and hardware-specific builds.
• If patching is delayed, disable unused affected drivers or hardware support and restrict local access to device-management, audio, suspend/resume, and module-management capabilities.
• Monitor kernel logs and power-management/audio-driver errors for repeated Arizona/WM5102 failures that could indicate accidental triggering or attempted denial of service.
• Because this is not listed in CISA KEV, is not associated with ransomware in the provided data, and has very low EPSS, treat it as a targeted platform-hardening item unless the affected driver is broadly deployed in critical devices.