CVE-2026-53350

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: wm_adsp: Fix NULL dereference when removing firmware controls

In wm_adsp_control_remove() check that the priv pointer is not NULL

before attempting to cleanup what it points to.

When cs_dsp creates a control it calls wm_adsp_control_add_cb() so that

wm_adsp can create its own private control data. There are two cases

where private data is not created:

1. The control is a SYSTEM control, so an ALSA control is not created.

2. The codec driver has registered a control_add() callback that

hides the control, so wm_adsp_control_add() is not called.

When cs_dsp_remove destroys its control list it calls

wm_adsp_control_remove() for each control. But wm_adsp_control_remove()

was attempting to cleanup the private data pointed to by cs_ctl->priv

without checking the pointer for NULL.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References