mailbox: mtk-adsp: fix UAF during device teardown

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-72486
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-15 06:22:22 UTC
Updated2026-08-17 06:19:16 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize (e.g. firmware boot timeout), its devres unwind frees the snd_sof_dev object that the mailbox client (mtk-adsp-ipc) reaches via chan->cl->rx_callback. The mtk-adsp-mailbox shutdown clears the mailbox command registers but leaves the IRQ line unmasked, so a late interrupt can still queue a threaded handler after mbox_free_channel() had cleared chan->cl, and mbox_chan_received_data() would then trigger UAF: BUG: KASAN: slab-use-after-free in sof_ipc3_validate_fw_version sof_ipc3_validate_fw_version sof_ipc3_do_rx_work sof_ipc3_rx_msg mt8196_dsp_handle_request mtk_adsp_ipc_recv mbox_chan_received_data mtk_adsp_mbox_isr irq_thread_fn Freed by task ...: kfree devres_release_all really_probe ... (sof-audio-of-mt8196 probe failure) The crash was observed roughly three seconds after the failed probe. disable_irq() in shutdown and enable_irq() in startup. disable_irq() also waits for any in-flight interrupts, so by the time mbox_free_channel() proceeds to clear chan->cl no rx_callback can run. In addition, request the IRQ with IRQF_NO_AUTOEN so it stays masked between probe and the first client bind — otherwise an early interrupt can crash on chan->cl == NULL in mbox_chan_received_data().

Risk And Classification

EPSS: 0.001800000 probability, percentile 0.078740000 (date 2026-08-17)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected af2dfa96c52d042df5deb29fb6e32d3ff4d76a61 b6337a08a63eef8efcffe3c01d479badda6bbbdb git Not specified
CNA Linux Linux affected af2dfa96c52d042df5deb29fb6e32d3ff4d76a61 e519c1d8c5efb5cd8d4c5bb3fe39b1bbb812bdb9 git Not specified
CNA Linux Linux affected af2dfa96c52d042df5deb29fb6e32d3ff4d76a61 fc6c3deb1d4c0adebf7dee0b8af4082af3f17690 git Not specified
CNA Linux Linux affected af2dfa96c52d042df5deb29fb6e32d3ff4d76a61 7d881615fb6373f71fc628b3f00186aeca87a3d5 git Not specified
CNA Linux Linux affected af2dfa96c52d042df5deb29fb6e32d3ff4d76a61 25d6ea6c76e1b1b7c57337b2f8f1b6fc8d5c52bc git Not specified
CNA Linux Linux affected af2dfa96c52d042df5deb29fb6e32d3ff4d76a61 b57d1a40bc43258372fa1f4d39305e093947a262 git Not specified
CNA Linux Linux affected 5.18 Not specified
CNA Linux Linux unaffected 5.18 semver Not specified
CNA Linux Linux unaffected 6.1.178 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.145 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.97 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.40 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.5 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/7d881615fb6373f71fc628b3f00186aeca87a3d5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e519c1d8c5efb5cd8d4c5bb3fe39b1bbb812bdb9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/25d6ea6c76e1b1b7c57337b2f8f1b6fc8d5c52bc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fc6c3deb1d4c0adebf7dee0b8af4082af3f17690 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b6337a08a63eef8efcffe3c01d479badda6bbbdb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b57d1a40bc43258372fa1f4d39305e093947a262 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report