CVE-2026-80911: Linux Kernel ASoC Use-After-Free Vulnerability

CVE-2026-80911 Overview

CVE-2026-80911 affects the Linux kernel's Sound Open Firmware (SOF) audio subsystem. The flaw resides in the sof_widget_setup_unlocked() function within the ASoC (ALSA System on Chip) driver code. When either tplg_ops->dai_config or widget_kcontrol_setup fails during widget setup, the error path incorrectly falls through and invokes sof_widget_free_unlocked() twice. This double invocation causes a double decrement of the widget's use_count and a duplicate core_put() call.

The kernel developers have merged fixes across multiple stable branches to correct the error handling logic in the audio widget lifecycle.

Critical Impact
The double decrement of reference counts in the SOF audio widget setup path can lead to reference counter corruption, potentially causing kernel instability or use-after-free conditions on systems using Sound Open Firmware audio drivers.

Affected Products

Linux kernel builds containing the ASoC SOF audio subsystem
Systems relying on Sound Open Firmware for DSP audio processing
Distributions shipping vulnerable versions of the sof-audio driver

Discovery Timeline

2026-09-04 - CVE-2026-80911 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80911

Vulnerability Analysis

The defect lives in sof_widget_setup_unlocked(), part of the SOF audio driver in the Linux kernel. The function orchestrates widget setup for DSP audio pipelines, including topology operations, DAI configuration, and kcontrol registration. When tplg_ops->dai_config or widget_kcontrol_setup returns an error, the current code path calls sof_widget_free_unlocked() and then falls through to a shared pipe_widget_free label that calls the free routine again.

Because sof_widget_free_unlocked() already handles the widget's use_count decrement and its associated core_put() release, invoking it twice decrements the counter below its correct value. This reference count imbalance can misrepresent widget liveness and disrupt DSP core power management. The fix returns directly from the error path rather than falling through to the shared cleanup label.

Root Cause

The root cause is an improper error path in resource cleanup logic, a class of defect often categorized under incorrect resource lifetime management. The sof_widget_setup_unlocked() function shares a single cleanup label for multiple error branches. Branches that already invoke sof_widget_free_unlocked() should return immediately rather than execute the label's second free call.

Attack Vector

Exploitation requires triggering a failure inside tplg_ops->dai_config or widget_kcontrol_setup during widget setup. This typically occurs when a topology load or DAI configuration operation fails on a system with SOF-based audio hardware. Local access with the ability to load or reload audio topologies is generally required. The vulnerability is not remotely triggerable in typical deployments.

See the applied patches for exact technical details: Linux Kernel Patch 8cba53b, Linux Kernel Patch b270ed3, Linux Kernel Patch c069956, Linux Kernel Patch d48691e, and Linux Kernel Patch e780e49.

Detection Methods for CVE-2026-80911

Indicators of Compromise

Unexpected kernel log entries related to sof-audio widget setup failures or DSP core state mismatches.
Audio subsystem instability, DSP firmware crashes, or ALSA device errors after failed topology loads.
Reference count warnings or refcount_t underflow messages in dmesg referencing SOF widget structures.

Detection Strategies

Inventory Linux hosts using SOF audio drivers by inspecting /sys/kernel/debug/sof and loaded modules such as snd_sof.
Compare running kernel versions against distribution advisories referencing the patch commits listed above.
Enable kernel CONFIG_REFCOUNT_FULL or equivalent runtime checks to surface reference count anomalies.

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized log platform and alert on SOF-related error patterns.
Track kernel package versions across the fleet and flag hosts running pre-patch kernels.
Monitor audio driver crash telemetry from endpoints, particularly on Intel-based laptops that depend on SOF DSP audio.

How to Mitigate CVE-2026-80911

Immediate Actions Required

Apply the patched Linux kernel from your distribution vendor as soon as backports become available.
Prioritize patching endpoints that use SOF-based audio hardware and load user-controlled topologies.
Restrict local users who can trigger audio topology reloads on affected systems.

Patch Information

The upstream fix has been merged into multiple stable branches. The applicable commits are 8cba53b, b270ed3, c069956, d48691e, and e780e49, all hosted on git.kernel.org. The fix removes the fall-through in the error path so that sof_widget_free_unlocked() and core_put() are only invoked once per failure branch. Consult your distribution's kernel changelog to confirm which commit is included in your packaged kernel.

Workarounds

If patching is not immediately feasible, avoid dynamic topology reloads on SOF-based systems.
Disable or blacklist the snd_sof module on systems where SOF audio is not required.
Limit local shell access to trusted users to reduce opportunities for triggering the vulnerable code path.

bash

# Verify running kernel version and SOF module status
uname -r
lsmod | grep snd_sof

# Temporarily blacklist snd_sof if unused (requires reboot)
echo "blacklist snd_sof" | sudo tee /etc/modprobe.d/blacklist-snd-sof.conf