SB20260507275 - Improper control of a resource through its lifetime in Linux kernel soc sdca

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43095)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource lifecycle management in sdca_irq_populate() IRQ handling when tearing down the sound card. A local user can trigger sound card teardown while IRQ handlers still hold references to the card and kcontrols to cause a denial of service.

The issue occurs because IRQs can persist after the sound card is removed, leading to crashes when stale references are used.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9
• https://git.kernel.org/stable/c/b022da127bd9d2217e8f285e643caf5aff6f7f14