Cloudanix VulnDB

CVE-2026-80911

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A mistake in Linux sound handling could let attackers crash computers or run unwanted code by interfering with audio device setup.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Double decrement of widget use_count and double core_put invocation in the error path of sof_widget_setup_unlocked when tplg_ops->dai_config or widget_kcontrol_setup fails, resulting in use-after-free via repeated sof_widget_free_unlocked calls.

Why it matters to the business

Kernel instability, crashes, or potential memory corruption on Linux systems using Sound Open Firmware audio drivers, risking denial of service or escalation in audio-enabled environments.

How an attack unfolds

An attacker supplies audio topology or configuration that causes partial widget initialization to fail, triggering the double-free path to corrupt kernel memory structures for further exploitation.

How to fix it

Apply the upstream fix that returns early from sof_widget_setup_unlocked on error without falling through the pipe_widget_free label; rebuild and deploy the patched kernel.

How to confirm the fix worked

Inspect sof-audio.c for the early return on widget setup failure; confirm absence of double sof_widget_free_unlocked paths via code review or kernel build tests.

Typical attack path

  1. Load or configure SOF audio topology that exercises widget setup
  2. Force failure in dai_config or kcontrol setup after initial allocation
  3. Trigger double free of use_count and core_put references
  4. Leverage resulting use-after-free for memory corruption or control flow hijack

How to detect it

Search kernel logs and crash dumps for repeated SOF widget free operations or use-after-free warnings in sof-audio paths.

What your security team should do

  • Prioritize kernel update for systems using ASoC SOF drivers
  • Test audio subsystem stability post-patch under error conditions
  • Monitor kernel logs for SOF widget-related oops or warnings

The record

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() If either tplg_ops->dai_config or widget_kcontrol_setup fail during widget setup we would double decrement the use_count of the widget because the sof_widget_free_unlocked() would be called twice, similarly the core_put would be invoked twice as well. Since the use_count and core_put() is handled within the widget_free function we need to return without falling through the pipe_widget_free label. The fixes tag is picked to the last change around this part of the code which is adequately old enough for backporting purposes.

Affected packages

Ecosystem Package Introduced Fixed