CVE-2026-43459

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ASoC: soc-core: flush delayed work before removing DAIs and widgets<br /> <br /> When a sound card is unbound while a PCM stream is open, a<br /> use-after-free can occur in snd_soc_dapm_stream_event(), called from<br /> the close_delayed_work workqueue handler.<br /> <br /> During unbind, snd_soc_unbind_card() flushes delayed work and then<br /> calls soc_cleanup_card_resources(). Inside cleanup,<br /> snd_card_disconnect_sync() releases all PCM file descriptors, and<br /> the resulting PCM close path can call snd_soc_dapm_stream_stop()<br /> which schedules new delayed work with a pmdown_time timer delay.<br /> Since this happens after the flush in snd_soc_unbind_card(), the<br /> new work is not caught. soc_remove_link_components() then frees<br /> DAPM widgets before this work fires, leading to the use-after-free.<br /> <br /> The existing flush in soc_free_pcm_runtime() also cannot help as it<br /> runs after soc_remove_link_components() has already freed the widgets.<br /> <br /> Add a flush in soc_cleanup_card_resources() after<br /> snd_card_disconnect_sync() (after which no new PCM closes can<br /> schedule further delayed work) and before soc_remove_link_dais()<br /> and soc_remove_link_components() (which tear down the structures the<br /> delayed work accesses).