CVE-2026-72486

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mailbox: mtk-adsp: fix UAF during device teardown

When the SOF audio driver fails to initialize (e.g. firmware boot

timeout), its devres unwind frees the snd_sof_dev object that the

mailbox client (mtk-adsp-ipc) reaches via chan->cl->rx_callback.

The mtk-adsp-mailbox shutdown clears the mailbox command registers

but leaves the IRQ line unmasked, so a late interrupt can still

queue a threaded handler after mbox_free_channel() had cleared

chan->cl, and mbox_chan_received_data() would then trigger UAF:

BUG: KASAN: slab-use-after-free in sof_ipc3_validate_fw_version

sof_ipc3_validate_fw_version

sof_ipc3_do_rx_work

sof_ipc3_rx_msg

mt8196_dsp_handle_request

mtk_adsp_ipc_recv

mbox_chan_received_data

mtk_adsp_mbox_isr

irq_thread_fn

Freed by task ...:

kfree

devres_release_all

really_probe

... (sof-audio-of-mt8196 probe failure)

The crash was observed roughly three seconds after the fa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References