Cloudanix VulnDB

CVE-2026-93185

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in Linux audio driver cleanup could leave background tasks running after the driver is removed, risking instability on systems that use certain SoundWire sound hardware.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Race condition in rt700_sdw_remove allows delayed work items (jack_detect_work, jack_btn_check_work) to remain active after the codec-private data lifetime ends because cancellation is gated on a mutable hw_init flag that can be cleared on UNATTACHED status.

Why it matters to the business

Kernel instability or crashes during SoundWire device removal or hot-unplug events can disrupt audio functionality on affected systems and require reboots, though the low EPSS and lack of KEV listing indicate limited real-world reach.

How an attack unfolds

An attacker with local access triggers rt700_interrupt_callback or jack_init to queue work, forces an UNATTACHED status transition that clears hw_init, then causes driver remove; the pending work is not canceled, leaving an active timer associated with freed objects as shown in the QEMU PoC.

How to fix it

Update the Linux kernel to the version containing the unconditional drain of jack_detect_work and jack_btn_check_work in rt700_sdw_remove regardless of hw_init state; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting rt700_sdw_remove for unconditional cancel_delayed_work calls; re-run the QEMU scenario that previously triggered DEBUG_OBJECTS to verify no active objects remain after remove.

Typical attack path

  1. Obtain local access on a Linux system using the rt700 SoundWire codec driver
  2. Cause or simulate device initialization and queue jack work via interrupt or jack_init paths
  3. Trigger SDW_SLAVE_UNATTACHED status to clear hw_init while work remains pending
  4. Initiate driver remove before the work executes
  5. Observe DEBUG_OBJECTS warning or subsequent use-after-free when the work fires

How to detect it

Review kernel logs for DEBUG_OBJECTS warnings mentioning rt700 jack work paths after device removal or UNATTACHED events; examine dmesg and ftrace for delayed work scheduling around rt700_sdw_remove calls.

What your security team should do

  • Prioritize kernel updates on systems exposing SoundWire audio devices within the next maintenance window given the 37-day publication age
  • Monitor vendor advisories for backported fixes in distribution kernels
  • Audit custom or embedded kernels for the rt700 driver and apply equivalent lifecycle cleanup changes

The record

In the Linux kernel, the following vulnerability has been resolved: ASoC: rt700-sdw: always drain jack work on remove rt700_sdw_remove() drains jack_detect_work and jack_btn_check_work only when rt700->hw_init is true. That state bit is cleared by rt700_update_status() when the SoundWire slave becomes UNATTACHED, but a jack work item can already have been queued by rt700_interrupt_callback() or rt700_jack_init() while the device was initialized. Do not use hw_init as the remove-time guard for draining these work objects. The delayed works are initialized during rt700_init(), so remove can cancel them unconditionally and pair the object lifetime with the codec-private data lifetime instead of a mutable hardware state bit. This issue was found by our static analysis tool and then confirmed by manual review of the SoundWire status, interrupt and remove paths. The remove path should drain work based on whether the work object exists, not on a runtime hardware state bit that can change after the work was queued. A QEMU PoC queued jack_detect_work, simulated SDW_SLAVE_UNATTACHED, and then entered remove. DEBUG_OBJECTS reported an active timer/work object associated with the rt700 jack work path after remove skipped the cancel. This is sent as an RFC because the practical trigger depends on SoundWire core remove ordering after an UNATTACHED status update. If remove cannot run after hw_init has been cleared while jack work is still pending, this is a defensive lifecycle cleanup rather than a reachable race on current systems.

Affected packages

Ecosystem Package Introduced Fixed