CVE-2026-45963: Linux Kernel Privilege Escalation Flaw

CVE-2026-45963 Overview

CVE-2026-45963 is a Linux kernel vulnerability in the ASoC (ALSA System on Chip) nau8821 audio codec driver. The flaw occurs when the driver is unloaded while a jack detection delayed work item remains pending. When the workqueue later schedules nau8821_jdet_work for execution, the function references code and data that no longer exist, triggering a kernel page fault. The bug was observed on Valve Jupiter (Steam Deck) hardware and resolved by cancelling unscheduled jdet_work or waiting for its completion before component removal.

Critical Impact
Local users with module unload privileges can trigger a kernel crash, leading to denial of service on affected Linux systems using the nau8821 audio codec.

Affected Products

Linux kernel builds including the ASoC nau8821 codec driver (snd_soc_nau8821)
Devices using the Nuvoton NAU8821 audio codec (e.g., Valve Steam Deck / Jupiter hardware)
Stable kernel branches prior to commits 3955767ec39d and dbd3fd05cddf

Discovery Timeline

2026-05-27 - CVE-2026-45963 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45963

Vulnerability Analysis

The vulnerability resides in the nau8821_jdet_work delayed work handler within the snd_soc_nau8821 kernel module. The driver schedules this work item to handle headphone jack detection events. When the component driver is removed without cancelling pending work, the workqueue retains a reference to a function pointer inside the unloaded module.

When the workqueue subsequently executes the stale callback, the kernel attempts to dereference an address in unmapped memory. The reported crash trace shows a page fault at __mutex_lock+0x9f/0x11d0, reached via nau8821_jdet_work calling snd_soc_dapm_disable_pin against freed component state.

Root Cause

The nau8821 component driver did not call cancel_delayed_work_sync() against jdet_work during component removal. This omission allowed a delayed work item to outlive the module that owned its function pointer and data structures, producing a classic use-after-free condition on kernel module teardown.

Attack Vector

Exploitation requires local access with privileges sufficient to unload kernel modules, typically CAP_SYS_MODULE. An attacker triggers a jack detection event to queue nau8821_jdet_work, then unloads snd_soc_nau8821 before the work executes. The primary impact is denial of service through kernel oops or panic. The two-commit fix is published at the kernel.org stable tree and follow-up commit, which add the missing cancellation call in the component remove path.

Detection Methods for CVE-2026-45963

Indicators of Compromise

Kernel oops or page fault messages referencing nau8821_jdet_work in dmesg or /var/log/kern.log.
Workqueue stack traces naming Workqueue: events nau8821_jdet_work [snd_soc_nau8821] followed by __mutex_lock and snd_soc_dapm_disable_pin.
Unexpected unloads of the snd_soc_nau8821 module on devices with active audio sessions.

Detection Strategies

Monitor kernel ring buffer output for BUG: unable to handle page fault entries correlated with audio subsystem modules.
Audit module load and unload events through auditd rules targeting init_module and delete_module syscalls.
Inventory running kernel versions against the fixed stable commits to identify exposed hosts.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on nau8821 faults.
Track module unload activity on multi-user Linux endpoints, especially developer or kiosk systems with the codec present.
Validate that automated update tooling has applied the relevant stable kernel patches.

How to Mitigate CVE-2026-45963

Immediate Actions Required

Update affected systems to a Linux stable kernel release containing commits 3955767ec39d and dbd3fd05cddf.
Restrict module unload capabilities by limiting CAP_SYS_MODULE to administrative accounts only.
Reboot after patching to ensure the corrected snd_soc_nau8821 module is loaded.

Patch Information

The fix cancels or waits for completion of jdet_work before the nau8821 component driver is removed. Vendor and distribution kernels should pick up the upstream changes referenced in the kernel commit and the updated commit.

Workarounds

Avoid unloading snd_soc_nau8821 on production systems until the patched kernel is deployed.
Blacklist the module on systems that do not require NAU8821 audio support using /etc/modprobe.d/.
Lock down kernel module operations using kernel.modules_disabled=1 once the required modules have loaded at boot.

bash

# Disable further module loading and unloading after boot
echo 1 > /proc/sys/kernel/modules_disabled

# Verify the running kernel is patched (example check)
modinfo snd_soc_nau8821 | grep -E 'filename|version'