SB20260827112 - Improper control of a resource through its lifetime in Linux kernel soc sof

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80525)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to stale cached configuration data in ASoC SOF ipc4-topology copier widget setup when handling suspend and resume cycles. A local user can trigger stream reallocation after suspend and resume to cause a denial of service.

The issue occurs because persisted widget state can cause reused IPC payloads to retain outdated DMA channel assignments.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0c0e418dbcf0582bf80d8dbfd9b306607c065992
• https://git.kernel.org/stable/c/2a7d8fc0fd50e7a2020989d9840cabb74c0282e3
• https://git.kernel.org/stable/c/574498e56024082a0da68474ad4526d250732411
• https://git.kernel.org/stable/c/decb87e76716d11d846c9c055e309c8ff90d7656