Improper Check or Handling of Exceptional Conditions in Linux kernel - CVE-2026-80581
Published: August 27, 2026
Vulnerability identifier: #VU145906
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80581
CWE-ID: CWE-703
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of IPC timeout conditions in sof_ipc4_trigger_pipelines in sound/soc/sof/ipc4-pcm.c when processing pipeline trigger state changes. A local user can trigger pipeline state transitions that encounter an IPC timeout to cause a denial of service.
The issue occurs when reply handling is blocked by system scheduling blockage, which can leave internal pipeline state handling inconsistent until the DSP is booted again.
Affected software
Linux kernel
How to mitigate CVE-2026-80581
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3