CVE-2026-43459

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: soc-core: flush delayed work before removing DAIs and widgets

When a sound card is unbound while a PCM stream is open, a

use-after-free can occur in snd_soc_dapm_stream_event(), called from

the close_delayed_work workqueue handler.

During unbind, snd_soc_unbind_card() flushes delayed work and then

calls soc_cleanup_card_resources(). Inside cleanup,

snd_card_disconnect_sync() releases all PCM file descriptors, and

the resulting PCM close path can call snd_soc_dapm_stream_stop()

which schedules new delayed work with a pmdown_time timer delay.

Since this happens after the flush in snd_soc_unbind_card(), the

new work is not caught. soc_remove_link_components() then frees

DAPM widgets before this work fires, leading to the use-after-free.

The existing flush in soc_free_pcm_runtime() also cannot help as it

runs after soc_remove_link_components() has already freed the widgets.

Add a flush in soc_cleanup_card_resour

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References