CVE-2026-80525: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80525 Overview

CVE-2026-80525 affects the Linux kernel's Sound Open Firmware (SOF) audio subsystem, specifically the ASoC ipc4-topology driver. The flaw involves a stale cached Inter-Process Communication (IPC) payload sent to audio firmware after suspend/resume cycles. The ipc_config_data buffer for copier widgets is built once during ipc_prepare and cached for reuse, but the cached copy is not refreshed when Direct Memory Access (DMA) streams are re-allocated with different stream tags. Firmware receives boot-time DMA channel assignments that no longer match runtime state, producing DMA channel conflicts, firmware errors, and system crashes.

Critical Impact
Stale IPC payloads after suspend/resume trigger DMA channel conflicts, firmware errors, and kernel-level crashes on affected Linux audio stacks.

Affected Products

Linux kernel — ASoC SOF ipc4-topology driver
Systems using SOF host copiers with host DMA streams
Systems using SOF DAI copiers with HDA link DMA (including SoundWire audio paths)

Discovery Timeline

2026-08-26 - CVE-2026-80525 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80525

Vulnerability Analysis

The SOF driver builds ipc_config_data for copier widgets during ipc_prepare, invoked from sof_pcm_setup_connected_widgets. Host copiers embed copier_data with gtw_cfg.node_id representing the host DMA identifier. DAI copiers append a dma_config_tlv trailer carrying stream_id and dma_channel_id for HDA link DMA. The kernel caches this buffer for subsequent reuse.

On suspend/resume, both host and link DMA streams are released and reallocated. New allocations can return different stream tags. The copier_data and dma_config_tlv structures are updated in place by host_config and sdw_hda_dai_hw_params, but the widget list persisted in spcm->stream[].list survives across suspend. Consequently, sof_pcm_hw_params skips sof_pcm_setup_connected_widgets, and ipc_prepare never runs again to rebuild the cached IPC payload.

Root Cause

The root cause is a state synchronization defect between cached IPC configuration data and the live DMA channel state. The cached payload retains boot-time DMA channel assignments while the underlying DMA resources are reassigned during power transitions.

Attack Vector

This is a reliability and stability defect exposed during normal system power management activity. The condition triggers when audio streams are active across suspend/resume cycles on affected hardware, leading to firmware errors and crashes rather than a remote attack path. See the kernel commit series for the patch narrative.

See the referenced kernel commits for the exact patch diff:
 - 0c0e418dbcf0582bf80d8dbfd9b306607c065992
 - 2a7d8fc0fd50e7a2020989d9840cabb74c0282e3
 - 574498e56024082a0da68474ad4526d250732411
 - decb87e76716d11d846c9c055e309c8ff90d7656

Detection Methods for CVE-2026-80525

Indicators of Compromise

Kernel log entries reporting SOF firmware errors or IPC failures following a suspend/resume cycle.
DMA channel conflict messages emitted from the ASoC SOF stack after audio playback resumes.
Audio subsystem crashes or unresponsive playback tied to sof_ipc4_widget_setup code paths.

Detection Strategies

Correlate dmesg output for SOF driver warnings against system suspend/resume events in journalctl.
Monitor kernel version and SOF driver commit level across the fleet to identify unpatched hosts.
Track audio firmware crash telemetry from managed Linux endpoints to spot regression patterns.

Monitoring Recommendations

Ingest kernel and audit logs into a centralized log store and alert on repeated SOF IPC error signatures.
Baseline suspend/resume cycles on laptops with SOF-based audio and flag anomalous firmware reset counts.
Review vendor kernel advisories continuously for backports referencing ipc4-topology and dma_config_tlv.

How to Mitigate CVE-2026-80525

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the CVE record to all affected systems.
Rebuild and redeploy custom kernels that include the SOF ipc4-topology driver.
Validate audio functionality across multiple suspend/resume cycles after patching.

Patch Information

The fix refreshes the copier_data and dma_config_tlv portions of ipc_config_data inside sof_ipc4_widget_setup immediately before the IPC message is sent. For DAI copiers, gtw_cfg.config_length is temporarily inflated to include the TLV size, mirroring the layout produced by sof_ipc4_prepare_copier_module, then restored. Patch commits are available in the stable kernel tree, including commit 2a7d8fc, commit 574498e, and commit decb87e.

Workarounds

Disable system suspend on affected hosts until kernel patches are deployed.
Unload or blacklist the SOF driver stack on non-audio-critical systems if firmware crashes disrupt operation.
Restart the audio subsystem or reboot after resume to force a fresh ipc_prepare cycle as a temporary bypass.

bash

# Verify running kernel and SOF module version
uname -r
modinfo snd-sof | grep -E '^(version|srcversion|filename):'

# Inspect recent SOF errors after a suspend/resume cycle
journalctl -k --since "1 hour ago" | grep -iE 'sof|ipc4|dma'