CVE-2026-43459ASoC: soc-core: flush delayed work before removing DAIs and widgets
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-core: flush delayed work before removing DAIs and widgets When a sound card is unbound while a PCM stream is open, a use-after-free can occur in snd_soc_dapm_stream_event(), called from the close_delayed_work workqueue handler. During unbind, snd_soc_unbind_card() flushes delayed work and then calls soc_cleanup_card_resources(). Inside cleanup, snd_card_disconnect_sync() releases all PCM file descriptors, and the resulting PCM close path can call snd_soc_dapm_stream_stop() which schedules new delayed work with a pmdown_time timer delay. Since this happens after the flush in snd_soc_unbind_card(), the new work is not caught. soc_remove_link_components() then frees DAPM widgets before this work fires, leading to the use-after-free. The existing flush in soc_free_pcm_runtime() also cannot help as it runs after soc_remove_link_components() has already freed the widgets. Add a flush in soc_cleanup_card_resources() after snd_card_disconnect_sync() (after which no new PCM closes can schedule further delayed work) and before soc_remove_link_dais() and soc_remove_link_components() (which tear down the structures the delayed work accesses).
- CVSS
- 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from e894efef9ac7c10b7727798dcc711cccf07569f9 before bf80a89da97285d9b877e0c6995e870d46b8025c; from e894efef9ac7c10b7727798dcc711cccf07569f9 before 3887e514978d28216246360b46a9cb534969eb5a; from e894efef9ac7c10b7727798dcc711cccf07569f9 before 231568afbc0cd25b8fb2a94ebf9738eabe1cf007; from e894efef9ac7c10b7727798dcc711cccf07569f9 before 317a9298c54bb00319da73e5a7179f00e67fcbdf; from e894efef9ac7c10b7727798dcc711cccf07569f9 before eab71e11ce2447c1e01809cbc11eab4234cf8dc8; from e894efef9ac7c10b7727798dcc711cccf07569f9 before 7d33e6140945482a07f8089ee86e13e02553ffdb; from e894efef9ac7c10b7727798dcc711cccf07569f9 before c054f0607c8bb1b1aa529bc109e4149298a1cccd; from e894efef9ac7c10b7727798dcc711cccf07569f9 before 95bc5c225513fc3c4ce169563fb5e3929fbb938b | CNA record |
linux linux_kernel linux:linux_kernel | from 4.20 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.19; from 6.19 before 6.19.9; 7.0; and 2 more ranges | NVD |
References
- https://git.kernel.org/stable/c/bf80a89da97285d9b877e0c6995e870d46b8025cpatch
- https://git.kernel.org/stable/c/3887e514978d28216246360b46a9cb534969eb5apatch
- https://git.kernel.org/stable/c/231568afbc0cd25b8fb2a94ebf9738eabe1cf007patch
- https://git.kernel.org/stable/c/317a9298c54bb00319da73e5a7179f00e67fcbdfpatch
- https://git.kernel.org/stable/c/eab71e11ce2447c1e01809cbc11eab4234cf8dc8patch
- https://git.kernel.org/stable/c/7d33e6140945482a07f8089ee86e13e02553ffdbpatch
- https://git.kernel.org/stable/c/c054f0607c8bb1b1aa529bc109e4149298a1cccdpatch
- https://git.kernel.org/stable/c/95bc5c225513fc3c4ce169563fb5e3929fbb938bpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.