CVE-2026-80911
Received Received - Intake

Double Free in Linux Kernel SOF Audio Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() If either tplg_ops->dai_config or widget_kcontrol_setup fail during widget setup we would double decrement the use_count of the widget because the sof_widget_free_unlocked() would be called twice, similarly the core_put would be invoked twice as well. Since the use_count and core_put() is handled within the widget_free function we need to return without falling through the pipe_widget_free label. The fixes tag is picked to the last change around this part of the code which is adequately old enough for backporting purposes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80911
EUVD
EUVD-2026-71614

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a double decrement issue in the ASoC SOF audio subsystem. During widget setup, if certain operations fail, the widget's use_count and core_put() are decremented twice due to improper error handling. This leads to incorrect resource management.

Detection Guidance

This vulnerability is specific to the Linux kernel's ASoC SOF subsystem and requires kernel-level inspection. Detection involves checking kernel logs for errors related to widget setup failures in the SOF driver. Commands like dmesg | grep -i sof or journalctl -k | grep -i sof may reveal relevant errors. Ensure your kernel version is updated to a patched release.

Impact Analysis

This vulnerability could cause system instability or crashes in systems using the affected Linux kernel audio subsystem. It may lead to resource leaks or improper cleanup, potentially affecting audio functionality or system performance.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to widget setup in the ASoC subsystem, involving double decrementing of use counts and core_put invocations. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-80911. If immediate patching is not possible, restrict access to audio-related kernel modules or disable the SOF driver if not required. Monitor kernel logs for widget setup failures as a sign of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80911. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart