CVE-2026-43095
Description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SDCA: Fix errors in IRQ cleanup
IRQs are enabled through sdca_irq_populate() from component probe using devm_request_threaded_irq(), this however means the IRQs can persist if the sound card is torn down. Some of the IRQ handlers store references to the card and the kcontrols which can then fail. Some detail of the crash was explained in [1].
Generally it is not advised to use devm outside of bus probe, so the code is updated to not use devm. The IRQ requests are not moved to bus probe time as it makes passing the snd_soc_component into the IRQs very awkward and would the require a second step once the component is available, so it is simpler to just register the IRQs at this point, even though that necessitates some manual cleanup.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Linux kernel ASoC SDCA driver fix: IRQs registered via devm persist after sound card teardown, causing use-after-free of card/kcontrol references.
Vulnerability
In the Linux kernel's ASoC SDCA (SoundWire SDCA) driver, IRQs are enabled via sdca_irq_populate() using devm_request_threaded_irq() from the component probe function. This binds IRQ lifetimes to the device's managed resource list, meaning the IRQs may persist after the sound card is torn down. Some IRQ handlers store pointers to the sound card and kcontrols, which become invalid, leading to use-after-free conditions.
Attack
Vector An attacker with local access and the ability to trigger sound card teardown (e.g., unbinding the driver or removing the soundwire device) can cause the dangling IRQ handlers to access freed memory. No special privileges are required beyond the ability to interact with the audio subsystem; the crash occurs during normal card removal if the IRQ fires after teardown.
Impact
A successful exploit results in a kernel crash (denial of service). The description notes that the crash was explained in a referenced commit [1]. By exploiting the race between IRQ removal and card destruction, an attacker can cause system instability or a denial-of-service condition.
Mitigation
The fix removes the use of devm_request_threaded_irq() and registers IRQs manually. The IRQ registration is not moved to bus probe time due to the need for the snd_soc_component pointer; instead, manual cleanup is added to ensure IRQs are freed before the card is torn down [2]. This patch is included in the mainline kernel.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.