CVE-2026-53348None▾ Sunlit

ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions sdca_dev_unregister_functions() iterates over all SDCA function descriptors and calls sdca_de…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 1, 2026

Updated

Nov 6, 2026

CVSS

—

Vendor

Linux

Product

Linux

CWE

—

Depth score

3 · Minimal

EPSS

0.14% · p4

Platforms

—

Source

CVEORG

Vector

—

CISA SSVC

decided 2026-11-06

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Nov 6.

0.1% → 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 128 days

Jul 1, 2026Published
Disclosed via CVEORG
Nov 6, 2026Record revised
Last analysed / modified upstream
Nov 6, 2026EPSS first tracked
0.1%

Linux #cve.org

Affected

Linux >= 4496d1c65bad7a3a32d2e09aaf3c54bc562c3fcc < 9a4895059bb6a8505098a9f75de187fd15631fc8
Linux >= 4496d1c65bad7a3a32d2e09aaf3c54bc562c3fcc < e4c60a1d4b6ccc66aefb3789cd908d4f9482eefd
Linux 6.19

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions

sdca_dev_unregister_functions() iterates over all SDCA function descriptors and calls sdca_dev_unregister() on each func_dev without checking for NULL. When a function registration has failed partway through, or the device cleanup races with probe deferral, func_dev entries may be NULL, leading to a kernel oops:

BUG: kernel NULL pointer dereference, address: 0000000000000040 RIP: 0010:device_del+0x1e/0x3e0 Call Trace: sdca_dev_unregister_functions+0x37/0x60 [snd_soc_sdca] release_nodes+0x35/0xb0 devres_release_all+0x90/0x100 device_unbind_cleanup+0xe/0x80 device_release_driver_internal+0x1c1/0x200 bus_remove_device+0xc6/0x130 device_del+0x161/0x3e0 device_unregister+0x17/0x60 sdw_delete_slave+0xb6/0xd0 [soundwire_bus] sdw_bus_master_delete+0x1e/0x50 [soundwire_bus] ... sof_probe_work+0x19/0x30 [snd_sof]

This was observed on a Lenovo ThinkPad X1 Carbon G14 (Panther Lake) with the SOF audio driver probe failing due to missing Panther Lake firmware, causing the subsequent cleanup of SoundWire devices to trigger the crash.

Fix this with three changes:

Add a NULL guard in sdca_dev_unregister() so that callers do not need to pre-validate the pointer (defense in depth).
In sdca_dev_unregister_functions(), skip NULL func_dev entries and clear func_dev to NULL after unregistration, making the function idempotent and safe against double-invocation.
In sdca_dev_register_functions(), roll back all previously registered functions when a later one fails, so the function array is never left in a partially-populated state.

Affected

Linux >= 4496d1c65bad7a3a32d2e09aaf3c54bc562c3fcc < 9a4895059bb6a8505098a9f75de187fd15631fc8
Linux >= 4496d1c65bad7a3a32d2e09aaf3c54bc562c3fcc < e4c60a1d4b6ccc66aefb3789cd908d4f9482eefd
Linux 6.19

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions

Fix this with three changes:

Add a NULL guard in sdca_dev_unregister() so that callers do not need to pre-validate the pointer (defense in depth).

In sdca_dev_unregister_functions(), skip NULL func_dev entries and clear func_dev to NULL after unregistration, making the function idempotent and safe against double-invocation.

In sdca_dev_register_functions(), roll back all previously registered functions when a later one fails, so the function array is never left in a partially-populated state.