ASoC: qdsp6 Topology Widget Type Validation Flaw

Publication date: 2026-06-24

Last updated on: 2026-07-21

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: qdsp6: topology: check widget type before accessing data Check widget type before accessing the private data, as this could a virtual widget which is no associated with a dsp graph, container and module. Accessing witout check could lead to incorrect memory access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-21

Generated

2026-08-04

AI Q&A

2026-06-24

EPSS Evaluated

2026-08-03

NVD

CVE-2026-53052

EUVD

EUVD-2026-38920

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.2 (inc) to 6.6.141 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.91 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's ASoC qcom qdsp6 topology component. It occurs because the code does not check the widget type before accessing its private data. Some widgets may be virtual and not associated with a DSP graph, container, or module. Accessing private data without verifying the widget type can lead to incorrect memory access.

Impact Analysis

The vulnerability can lead to incorrect memory access in the Linux kernel. This may cause system instability, crashes, or potentially allow an attacker to exploit the improper memory access to affect system behavior.

Hi! I’m here to help you understand CVE-2026-53052. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70