CVE-2026-72486

Received Received - Intake

Use-After-Free in Linux Kernel MTK ADSP Mailbox Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize (e.g. firmware boot timeout), its devres unwind frees the snd_sof_dev object that the mailbox client (mtk-adsp-ipc) reaches via chan->cl->rx_callback. The mtk-adsp-mailbox shutdown clears the mailbox command registers but leaves the IRQ line unmasked, so a late interrupt can still queue a threaded handler after mbox_free_channel() had cleared chan->cl, and mbox_chan_received_data() would then trigger UAF: BUG: KASAN: slab-use-after-free in sof_ipc3_validate_fw_version sof_ipc3_validate_fw_version sof_ipc3_do_rx_work sof_ipc3_rx_msg mt8196_dsp_handle_request mtk_adsp_ipc_recv mbox_chan_received_data mtk_adsp_mbox_isr irq_thread_fn Freed by task ...: kfree devres_release_all really_probe ... (sof-audio-of-mt8196 probe failure) The crash was observed roughly three seconds after the failed probe. disable_irq() in shutdown and enable_irq() in startup. disable_irq() also waits for any in-flight interrupts, so by the time mbox_free_channel() proceeds to clear chan->cl no rx_callback can run. In addition, request the IRQ with IRQF_NO_AUTOEN so it stays masked between probe and the first client bind — otherwise an early interrupt can crash on chan->cl == NULL in mbox_chan_received_data().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72486

EUVD

EUVD-2026-59385

Affected Vendors & Products

Vendor	Product	Version / Range
mtk	mtk_adsp	*
sof	sof_audio_driver	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's mailbox subsystem, specifically in the mtk-adsp driver. It occurs when the SOF audio driver fails to initialize, causing the snd_sof_dev object to be freed prematurely. The mailbox client (mtk-adsp-ipc) still references this freed object, leading to a crash when a late interrupt triggers a callback on the already-freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's mailbox subsystem and SOF audio driver. Detection requires checking kernel logs for use-after-free errors in the mtk-adsp or SOF components. Monitor dmesg for KASAN reports or crashes in sof_ipc3_validate_fw_version or mtk_adsp_ipc_recv.

Impact Analysis

This vulnerability can cause system crashes or instability when the SOF audio driver fails to initialize, particularly during firmware boot timeout. It may lead to kernel panics or unexpected behavior in systems using the affected mtk-adsp mailbox driver.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel mailbox driver issue causing a use-after-free condition in audio subsystem components. Compliance impacts would only occur if this vulnerability led to unauthorized data access or processing, which is not described in the provided context.

Mitigation Strategies

Apply the Linux kernel patch that fixes the UAF issue in the mtk-adsp mailbox driver. Ensure the SOF audio driver initializes properly to avoid firmware boot timeouts. Verify the IRQ handling changes (disable_irq in shutdown, IRQF_NO_AUTOEN in probe) are included in the patched kernel.

Hi! I’m here to help you understand CVE-2026-72486. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70