CVE-2026-31587

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ASoC: qcom: q6apm: move component registration to unmanaged version<br /> <br /> q6apm component registers dais dynamically from ASoC toplology, which<br /> are allocated using device managed version apis. Allocating both<br /> component and dynamic dais using managed version could lead to incorrect<br /> free ordering, dai will be freed while component still holding references<br /> to it.<br /> <br /> Fix this issue by moving component to unmanged version so<br /> that the dai pointers are only freeded after the component is removed.<br /> <br /> ==================================================================<br /> BUG: KASAN: slab-use-after-free in snd_soc_del_component_unlocked+0x3d4/0x400 [snd_soc_core]<br /> Read of size 8 at addr ffff00084493a6e8 by task kworker/u48:0/3426<br /> Tainted: [W]=WARN<br /> Hardware name: LENOVO 21N2ZC5PUS/21N2ZC5PUS, BIOS N42ET57W (1.31 ) 08/08/2024<br /> Workqueue: pdr_notifier_wq pdr_notifier_work [pdr_interface]<br /> Call trace:<br /> show_stack+0x28/0x7c (C)<br /> dump_stack_lvl+0x60/0x80<br /> print_report+0x160/0x4b4<br /> kasan_report+0xac/0xfc<br /> __asan_report_load8_noabort+0x20/0x34<br /> snd_soc_del_component_unlocked+0x3d4/0x400 [snd_soc_core]<br /> snd_soc_unregister_component_by_driver+0x50/0x88 [snd_soc_core]<br /> devm_component_release+0x30/0x5c [snd_soc_core]<br /> devres_release_all+0x13c/0x210<br /> device_unbind_cleanup+0x20/0x190<br /> device_release_driver_internal+0x350/0x468<br /> device_release_driver+0x18/0x30<br /> bus_remove_device+0x1a0/0x35c<br /> device_del+0x314/0x7f0<br /> device_unregister+0x20/0xbc<br /> apr_remove_device+0x5c/0x7c [apr]<br /> device_for_each_child+0xd8/0x160<br /> apr_pd_status+0x7c/0xa8 [apr]<br /> pdr_notifier_work+0x114/0x240 [pdr_interface]<br /> process_one_work+0x500/0xb70<br /> worker_thread+0x630/0xfb0<br /> kthread+0x370/0x6c0<br /> ret_from_fork+0x10/0x20<br /> <br /> Allocated by task 77:<br /> kasan_save_stack+0x40/0x68<br /> kasan_save_track+0x20/0x40<br /> kasan_save_alloc_info+0x44/0x58<br /> __kasan_kmalloc+0xbc/0xdc<br /> __kmalloc_node_track_caller_noprof+0x1f4/0x620<br /> devm_kmalloc+0x7c/0x1c8<br /> snd_soc_register_dai+0x50/0x4f0 [snd_soc_core]<br /> soc_tplg_pcm_elems_load+0x55c/0x1eb8 [snd_soc_core]<br /> snd_soc_tplg_component_load+0x4f8/0xb60 [snd_soc_core]<br /> audioreach_tplg_init+0x124/0x1fc [snd_q6apm]<br /> q6apm_audio_probe+0x10/0x1c [snd_q6apm]<br /> snd_soc_component_probe+0x5c/0x118 [snd_soc_core]<br /> soc_probe_component+0x44c/0xaf0 [snd_soc_core]<br /> snd_soc_bind_card+0xad0/0x2370 [snd_soc_core]<br /> snd_soc_register_card+0x3b0/0x4c0 [snd_soc_core]<br /> devm_snd_soc_register_card+0x50/0xc8 [snd_soc_core]<br /> x1e80100_platform_probe+0x208/0x368 [snd_soc_x1e80100]<br /> platform_probe+0xc0/0x188<br /> really_probe+0x188/0x804<br /> __driver_probe_device+0x158/0x358<br /> driver_probe_device+0x60/0x190<br /> __device_attach_driver+0x16c/0x2a8<br /> bus_for_each_drv+0x100/0x194<br /> __device_attach+0x174/0x380<br /> device_initial_probe+0x14/0x20<br /> bus_probe_device+0x124/0x154<br /> deferred_probe_work_func+0x140/0x220<br /> process_one_work+0x500/0xb70<br /> worker_thread+0x630/0xfb0<br /> kthread+0x370/0x6c0<br /> ret_from_fork+0x10/0x20<br /> <br /> Freed by task 3426:<br /> kasan_save_stack+0x40/0x68<br /> kasan_save_track+0x20/0x40<br /> __kasan_save_free_info+0x4c/0x80<br /> __kasan_slab_free+0x78/0xa0<br /> kfree+0x100/0x4a4<br /> devres_release_all+0x144/0x210<br /> device_unbind_cleanup+0x20/0x190<br /> device_release_driver_internal+0x350/0x468<br /> device_release_driver+0x18/0x30<br /> bus_remove_device+0x1a0/0x35c<br /> device_del+0x314/0x7f0<br /> device_unregister+0x20/0xbc<br /> apr_remove_device+0x5c/0x7c [apr]<br /> device_for_each_child+0xd8/0x160<br /> apr_pd_status+0x7c/0xa8 [apr]<br /> pdr_notifier_work+0x114/0x240 [pdr_interface]<br /> process_one_work+0x500/0xb70<br /> worker_thread+0x630/0xfb0<br /> kthread+0x370/0x6c0<br /> ret_from_fork+0x10/0x20