CVE-2026-43459High· 7.3▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: ASoC: soc-core: flush delayed work before removing DAIs and widgets When a sound card is unbound while a PCM stream is open, a use-after-free can occur in snd_soc_dapm…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
In the Linux kernel, the following vulnerability has been resolved:
ASoC: soc-core: flush delayed work before removing DAIs and widgets
When a sound card is unbound while a PCM stream is open, a use-after-free can occur in snd_soc_dapm_stream_event(), called from the close_delayed_work workqueue handler.
During unbind, snd_soc_unbind_card() flushes delayed work and then calls soc_cleanup_card_resources(). Inside cleanup, snd_card_disconnect_sync() releases all PCM file descriptors, and the resulting PCM close path can call snd_soc_dapm_stream_stop() which schedules new delayed work with a pmdown_time timer delay. Since this happens after the flush in snd_soc_unbind_card(), the new work is not caught. soc_remove_link_components() then frees DAPM widgets before this work fires, leading to the use-after-free.
The existing flush in soc_free_pcm_runtime() also cannot help as it runs after soc_remove_link_components() has already freed the widgets.
Add a flush in soc_cleanup_card_resources() after snd_card_disconnect_sync() (after which no new PCM closes can schedule further delayed work) and before soc_remove_link_dais() and soc_remove_link_components() (which tear down the structures the delayed work accesses).
Linux >= e894efef9ac7c10b7727798dcc711cccf07569f9 < bf80a89da97285d9b877e0c6995e870d46b8025cLinux >= e894efef9ac7c10b7727798dcc711cccf07569f9 < 3887e514978d28216246360b46a9cb534969eb5aLinux >= e894efef9ac7c10b7727798dcc711cccf07569f9 < 231568afbc0cd25b8fb2a94ebf9738eabe1cf007Linux >= e894efef9ac7c10b7727798dcc711cccf07569f9 < 317a9298c54bb00319da73e5a7179f00e67fcbdfLinux >= e894efef9ac7c10b7727798dcc711cccf07569f9 < eab71e11ce2447c1e01809cbc11eab4234cf8dc8Linux >= e894efef9ac7c10b7727798dcc711cccf07569f9 < 7d33e6140945482a07f8089ee86e13e02553ffdbLinux >= e894efef9ac7c10b7727798dcc711cccf07569f9 < c054f0607c8bb1b1aa529bc109e4149298a1cccdLinux >= e894efef9ac7c10b7727798dcc711cccf07569f9 < 95bc5c225513fc3c4ce169563fb5e3929fbb938bLinux 4.20Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-38564High· 7.8bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
CVE-2026-99092Noneriscv: patch: fix handling of bpf-jit execmem addresses
CVE-2026-99089NoneASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
CVE-2026-99093Nonemm: don't schedule deferred kernel page table freeing while booting
CVE-2026-99088Nonenet: openvswitch: validate transport header presence in set_ipv6_addr
CVE-2026-99090Nonedrm/amdgpu: serialize vblank counter reads against GPU reset