CVE-2026-80581
Description
From CVE.org
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout Ignore IPC errors for pipeline state change if the firmware state is crashed or the IPC has timed out. If the firmware has crashed the kernel still needs to go through the state changes to reset its internal to be able to correctly work the next time the DSP is booted up. The case with IPC timeout is a bit more problematic, but it has been rootcaused to be the result of system scheduling blockage and the firmware did actually received and handled the message, but the reply handling got blocked by issues outside of the SOF stack. So far the best way to handle this is to continue with setting the state.
Statement
A flaw was found in the Linux kernel ASoC: SOF ipc4-pcm driver. When a pipeline state change (trigger) encountered an error from the audio DSP firmware, such as a firmware crash or an IPC timeout, the kernel aborted the pipeline state transition, leaving its internal state inconsistent. As a result, the kernel may fail to correctly reset its internal state so that the audio DSP works correctly the next time it is booted, which can leave the audio subsystem in a broken or unrecoverable state until the system is restarted. An IPC timeout has been root-caused upstream to system scheduling blockage, where the firmware actually received and handled the message but the reply handling was blocked by issues outside of the SOF stack. This flaw has a low impact on Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm), where it is reachable only locally, by a user or process performing PCM audio operations that hit a firmware crash or IPC timeout condition. The impact is limited to availability of the audio DSP path; there is no evidence of memory corruption, information disclosure, or privilege escalation. Earlier streams (RHEL 6, 7, 8, and RHEL 9.2/9.4) are not affected because the vulnerable code is not present. Although the CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is moderate because of the high availability impact within the audio subsystem, Red Hat assesses the overall impact of this flaw as low, since triggering requires local access and specific firmware crash or IPC timeout conditions and only audio functionality is affected. The fix for the affected streams is currently deferred; the residual risk is a local denial of service limited to the audio subsystem.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
