CVE-2026-43412

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start<br /> <br /> During ADSP stop and start, the kernel crashes due to the order in which<br /> ASoC components are removed.<br /> <br /> On ADSP stop, the q6apm-audio .remove callback unloads topology and removes<br /> PCM runtimes during ASoC teardown. This deletes the RTDs that contain the<br /> q6apm DAI components before their removal pass runs, leaving those<br /> components still linked to the card and causing crashes on the next rebind.<br /> <br /> Fix this by ensuring that all dependent (child) components are removed<br /> first, and the q6apm component is removed last.<br /> <br /> [ 48.105720] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0<br /> [ 48.114763] Mem abort info:<br /> [ 48.117650] ESR = 0x0000000096000004<br /> [ 48.121526] EC = 0x25: DABT (current EL), IL = 32 bits<br /> [ 48.127010] SET = 0, FnV = 0<br /> [ 48.130172] EA = 0, S1PTW = 0<br /> [ 48.133415] FSC = 0x04: level 0 translation fault<br /> [ 48.138446] Data abort info:<br /> [ 48.141422] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000<br /> [ 48.147079] CM = 0, WnR = 0, TnD = 0, TagAccess = 0<br /> [ 48.152354] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0<br /> [ 48.157859] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001173cf000<br /> [ 48.164517] [00000000000000d0] pgd=0000000000000000, p4d=0000000000000000<br /> [ 48.171530] Internal error: Oops: 0000000096000004 [#1] SMP<br /> [ 48.177348] Modules linked in: q6prm_clocks q6apm_lpass_dais q6apm_dai snd_q6dsp_common q6prm snd_q6apm 8021q garp mrp stp llc snd_soc_hdmi_codec apr pdr_interface phy_qcom_edp fastrpc qcom_pd_mapper rpmsg_ctrl qrtr_smd rpmsg_char qcom_pdr_msg qcom_iris v4l2_mem2mem videobuf2_dma_contig ath11k_pci msm ubwc_config at24 ath11k videobuf2_memops mac80211 ocmem videobuf2_v4l2 libarc4 drm_gpuvm mhi qrtr videodev drm_exec snd_soc_sc8280xp gpu_sched videobuf2_common nvmem_qcom_spmi_sdam snd_soc_qcom_sdw drm_dp_aux_bus qcom_q6v5_pas qcom_spmi_temp_alarm snd_soc_qcom_common rtc_pm8xxx qcom_pon drm_display_helper cec qcom_pil_info qcom_stats soundwire_bus drm_client_lib mc dispcc0_sa8775p videocc_sa8775p qcom_q6v5 camcc_sa8775p snd_soc_dmic phy_qcom_sgmii_eth snd_soc_max98357a i2c_qcom_geni snd_soc_core dwmac_qcom_ethqos llcc_qcom icc_bwmon qcom_sysmon snd_compress qcom_refgen_regulator coresight_stm stmmac_platform snd_pcm_dmaengine qcom_common coresight_tmc stmmac coresight_replicator qcom_glink_smem coresight_cti stm_core<br /> [ 48.177444] coresight_funnel snd_pcm ufs_qcom phy_qcom_qmp_usb gpi phy_qcom_snps_femto_v2 coresight phy_qcom_qmp_ufs qcom_wdt gpucc_sa8775p pcs_xpcs mdt_loader qcom_ice icc_osm_l3 qmi_helpers snd_timer snd soundcore display_connector qcom_rng nvmem_reboot_mode drm_kms_helper phy_qcom_qmp_pcie sha256 cfg80211 rfkill socinfo fuse drm backlight ipv6<br /> [ 48.301059] CPU: 2 UID: 0 PID: 293 Comm: kworker/u32:2 Not tainted 6.19.0-rc6-dirty #10 PREEMPT<br /> [ 48.310081] Hardware name: Qualcomm Technologies, Inc. Lemans EVK (DT)<br /> [ 48.316782] Workqueue: pdr_notifier_wq pdr_notifier_work [pdr_interface]<br /> [ 48.323672] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> [ 48.330825] pc : mutex_lock+0xc/0x54<br /> [ 48.334514] lr : soc_dapm_shutdown_dapm+0x44/0x174 [snd_soc_core]<br /> [ 48.340794] sp : ffff800084ddb7b0<br /> [ 48.344207] x29: ffff800084ddb7b0 x28: ffff00009cd9cf30 x27: ffff00009cd9cc00<br /> [ 48.351544] x26: ffff000099610190 x25: ffffa31d2f19c810 x24: ffffa31d2f185098<br /> [ 48.358869] x23: ffff800084ddb7f8 x22: 0000000000000000 x21: 00000000000000d0<br /> [ 48.366198] x20: ffff00009ba6c338 x19: ffff00009ba6c338 x18: 00000000ffffffff<br /> [ 48.373528] x17: 000000040044ffff x16: ffffa31d4ae6dca8 x15: 072007740775076f<br /> [ 48.380853] x14: 0765076d07690774 x13: 00313a323a656369 x12: 767265733a637673<br /> [ 48.388182] x11: 00000000000003f9 x10: ffffa31d4c7dea98 x9 : 0000000000000001<br /> [ 48.395519] x8 : ffff00009a2aadc0 x7 : 0000000000000003 x6 : 0000000000000000<br /> [ 48.402854] x5 : 0000000000000<br /> ---truncated---