CVE-2026-80581: Linux Kernel ASoC SOF Privilege Escalation

CVE-2026-80581 Overview

CVE-2026-80581 affects the Linux kernel's Sound Open Firmware (SOF) Advanced Linux Sound Architecture (ALSA) System on Chip (ASoC) subsystem. The flaw exists in the ipc4-pcm pipeline trigger logic, where Inter-Process Communication (IPC) timeouts or firmware crashes prevented the kernel from completing pipeline state transitions. The resolved patch instructs the kernel to ignore IPC errors during pipeline state changes when the firmware state is crashed or the IPC has timed out. Without this fix, internal kernel state can remain inconsistent, preventing the Digital Signal Processor (DSP) from operating correctly on subsequent boots.

Critical Impact
Failure to progress pipeline state changes after firmware crash or IPC timeout leaves the SOF audio stack in an inconsistent state, impairing DSP recovery on the next boot cycle.

Affected Products

Linux kernel (mainline) sound/soc/sof/ipc4-pcm.c
Sound Open Firmware (SOF) driver stack
Stable branches referenced in the linked kernel.org commits

Discovery Timeline

2026-08-26 - CVE-2026-80581 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80581

Vulnerability Analysis

The issue resides in the SOF IPC4 Pulse Code Modulation (PCM) pipeline trigger path. When the DSP firmware crashes or an IPC message times out, the driver returned early on error instead of completing the pipeline state transition. The kernel then retained stale internal state associated with the audio pipeline. On the next DSP boot, the retained state prevented correct pipeline reinitialization, resulting in unreliable audio subsystem behavior.

This is a kernel driver logic flaw rather than a memory safety issue. The vulnerability class aligns with improper error handling in a resource state machine. Systems relying on Intel SOF audio DSPs are the primary population affected.

Root Cause

The root cause is that the ipc4-pcm trigger handler treated all IPC failures as terminal errors. Investigation of the timeout case showed the firmware actually received and processed the state-change message; the reply path was delayed by system scheduling pressure outside the SOF stack. Aborting the state transition on that signal left driver bookkeeping out of sync with firmware state.

Attack Vector

The advisory does not describe a remote or unprivileged attack path. The condition triggers when the firmware crashes or when the IPC reply is delayed beyond the timeout. Impact is limited to audio subsystem reliability and DSP recovery, not privilege escalation or code execution. See the kernel.org commit history for the full patch series.

No verified proof-of-concept exists. Refer to the patch commits for the exact code paths modified:

Detection Methods for CVE-2026-80581

Indicators of Compromise

Kernel log entries from the SOF driver reporting IPC timeout or firmware crash during snd_sof_pcm_platform_trigger execution.
Repeated DSP boot failures or audio pipeline state mismatches after a prior firmware fault.
dmesg messages referencing sof-audio state transition errors following a stalled IPC reply.

Detection Strategies

Inventory Linux hosts running SOF-based audio drivers and compare their kernel versions against the fixed stable branches.
Query package management systems for the installed kernel package version to identify unpatched endpoints.
Correlate crash telemetry from the audio subsystem with system scheduling latency spikes.

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized log store and alert on SOF IPC timeout patterns.
Track kernel package versions across the fleet with configuration management tooling.
Monitor DSP recovery events for repeated failures that indicate stale pipeline state.

How to Mitigate CVE-2026-80581

Immediate Actions Required

Update to a Linux kernel version that includes the four upstream commits referenced above.
Reboot affected systems after patching so the corrected driver is loaded.
Verify audio subsystem recovery by inducing a controlled DSP reload in a test environment.

Patch Information

The fix modifies sound/soc/sof/ipc4-pcm.c to continue pipeline state changes when the firmware state is crashed or when the IPC has timed out. Apply the vendor kernel update that carries commits 17661c67b206, 4931c09d8387, 6b512a5330ef, and f2435a46dfa1. Distribution kernels should be updated through the vendor's standard patch channel.

Workarounds

No supported workaround replaces applying the kernel patch.
On systems where audio is non-essential, blacklisting the SOF driver removes exposure to the pipeline trigger path.
Reduce scheduling pressure on audio-critical hosts to lower the frequency of IPC timeouts until patches are deployed.

bash

# Verify kernel version and confirm SOF module status after patching
uname -r
lsmod | grep snd_sof
dmesg | grep -iE 'sof|ipc4-pcm'