CVE-2026-46179: Linux Kernel ASoC SOF Divide by Zero

CVE-2026-46179 Overview

CVE-2026-46179 is a Linux kernel vulnerability in the Sound Open Firmware (SOF) ALSA System on Chip (ASoC) subsystem. The flaw resides in the compressed stream pointer reporting path, which divides the I/O frame position by the product of channel count and container byte size. Both values default to zero and are only populated when stream parameters are configured. A userspace process that queries the pointer before configuring the stream triggers a divide-by-zero in kernel context. The upstream fix validates these parameters and returns an error when either value is zero.

Critical Impact
Local userspace can trigger a kernel divide-by-zero in the SOF compressed audio path, leading to denial of service on affected Linux systems.

Affected Products

Linux kernel — ASoC SOF (Sound Open Firmware) subsystem
Systems using SOF-backed compressed audio streams
Distributions shipping kernels prior to the fixes referenced in the upstream stable commits

Discovery Timeline

2026-05-28 - CVE-2026-46179 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46179

Vulnerability Analysis

The vulnerability lives in the SOF compressed stream pointer callback. When userspace requests the current I/O frame position, the kernel computes the position by dividing a byte offset by channels * container_bytes. Both channels and the container byte width are initialized to zero and are only set when the stream is configured through the standard parameter-setting ioctls.

If a process calls the pointer operation on a stream that has not yet been configured, the divisor evaluates to zero. The arithmetic divide triggers a CPU exception in kernel context, producing an oops and rendering the audio subsystem unusable until reboot. The fix introduces explicit validation: if either value is zero, the pointer operation returns an error rather than performing the division.

This is classified as a Null Pointer Dereference DoS pattern in the broader sense, and specifically a divide-by-zero arithmetic fault in kernel code reachable from an unprivileged audio device handle.

Root Cause

The root cause is missing input validation on stream state before performing arithmetic that assumes configured parameters. The compressed stream structure permits the pointer callback to run before set_params populates channels and container width, violating the implicit precondition that these fields are non-zero.

Attack Vector

A local attacker with access to the audio device node opens a compressed PCM stream and issues the pointer query without first calling the parameter configuration ioctl. The resulting kernel divide-by-zero crashes the audio path. The vector is local and requires access to the ALSA compressed device interface.

No verified public exploit code is available. See the upstream patches for the precise code path: Linux Kernel Commit 0f0c0c1 and Linux Kernel Commit c5b6285.

Detection Methods for CVE-2026-46179

Indicators of Compromise

Kernel oops or divide error: 0000 entries in dmesg referencing SOF compressed stream pointer functions.
Unexpected termination of snd_sof or PulseAudio/PipeWire processes following audio device access.
Audio subsystem failures requiring system reboot to restore functionality on SOF-enabled hardware.

Detection Strategies

Monitor /var/log/kern.log and journalctl -k for divide error exceptions originating in ASoC SOF compressed stream code paths.
Inventory running kernel versions against the fixed commits listed in the upstream stable tree.
Audit processes that open /dev/snd/compr* device nodes, particularly any unprivileged binary issuing pointer ioctls without prior parameter configuration.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on divide error strings paired with sof or snd_compress stack frames.
Track audio subsystem crash frequency on endpoints with Intel SOF-capable hardware.
Establish a baseline of normal compressed-audio API consumers to identify anomalous callers.

How to Mitigate CVE-2026-46179

Immediate Actions Required

Apply the upstream stable kernel patch corresponding to your kernel branch and rebuild or update the kernel package.
Reboot systems after kernel updates to ensure the patched code path is active.
Restrict access to ALSA compressed device nodes to trusted users and processes only.

Patch Information

The fix has been merged across multiple Linux stable branches. Apply the appropriate commit for your kernel version:

The patch validates that channel count and container byte width are non-zero before performing the division, returning an error otherwise.

Workarounds

Where patching is not immediately feasible, tighten permissions on /dev/snd/compr* device nodes via udev rules to limit exposure to local users.
Disable the SOF driver on systems that do not require compressed audio offload, using a modprobe blacklist for snd_sof modules.
Restrict audio group membership to required service accounts and remove unnecessary local user accounts from groups granting audio device access.

bash

# Example: restrict access to ALSA compressed device nodes via udev
# /etc/udev/rules.d/90-snd-compr-restrict.rules
KERNEL=="compr*", SUBSYSTEM=="sound", MODE="0640", GROUP="audio"

# Reload udev rules
sudo udevadm control --reload-rules
sudo udevadm trigger