CVE-2026-43137

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix NULL pointer dereference If there's a mismatch between the DAI links in the machine driver and the topology, it is possible that the playback/capture widget is not set, especially in the case of loopbac...

CVE-2026-43095

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Fix errors in IRQ cleanup IRQs are enabled through sdcairqpopulate from component probe using devmrequestthreadedirq, this however means the IRQs can persist if the sound card is torn down. Some of the IRQ handlers...

PT-2026-37544

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASoC qcom q6asm component where DSP responses arriving after a data stream had been closed were still being handled. This failure to properly ignore these response...

CVE-2026-31776

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix missing SPDIFI1 index handling SPDIF1 DAIO type isn't properly handled in daiodeviceindex for hw20k2, and it returned -EINVAL, which ended up with the out-of-bounds array access. Follow the hw20k1 pattern and...

SUSE-SU-2026:1464-1 Security update for the Linux Kernel (Live Patch 28 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.113 fixes various security issues The following security issues were fixed: - CVE-2026-23191: ALSA: aloop: Fix racy access at PCM trigger bsc1258396. - CVE-2026-23268: apparmor: fix unprivileged local user can do privileged policy...

The vulnerability of the `wavefront_send_sample()` function in the sound subsystem of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the wavefrontsendsample function in the sound subsystem of the Linux kernel lies in integer overflow or cyclic shift vulnerabilities. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the `cs35l41_get_acpi_mute_state()` function in the sound subsystem of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the cs35l41getacpimutestate function in the sound/hda/codecs/side-codecs/cs35l41hda.c module of the Linux kernel sound subsystem is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-23301

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add allocation failure check for Entity name Currently findsdcaentityiot can allocate a string for the Entity name but it doesn't check if that allocation succeeded. Add the missing NULL check after the allocation...

CVE-2026-23301 ASoC: SDCA: Add allocation failure check for Entity name

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add allocation failure check for Entity name Currently findsdcaentityiot can allocate a string for the Entity name but it doesn't check if that allocation succeeded. Add the missing NULL check after the allocation...

The vulnerability of the detect_stream_formats() function in the sound subsystem of the Linux operating system’s kernel, which allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the detectstreamformats function in the sound/firewire/dice/dice-extension.c module of the Linux kernel’s sound subsystem is related to writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, an...

The vulnerability of the `snd_dg00x_stream_init_duplex()` function in the sound subsystem of the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the snddg00xstreaminitduplex function in the sound/firewire/digi00x/digi00x-stream.c module of the Linux kernel’s audio subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a system failure...

CVE-2026-23089 ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix use-after-free in sndusbmixerfree When sndusbcreatemixer fails, sndusbmixerfree frees mixer-idelems but the controls already added to the card still reference the freed memory. Later when sndcardregister runs...

SUSE CVE-2026-23006

In the Linux kernel, the following vulnerability has been resolved: ASoC: tlv320adcx140: fix null pointer The "sndsoccomponent" in "adcx140priv" was only used once but never set. It was only used for reaching "dev" which is already present in "adcx140priv"...

Azure Linux 3.0 Security Update: kernel (CVE-2024-46863)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-46863 advisory. - In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-lnl-match: a...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003719)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003719 advisory. An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/pcm.c driver...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004141)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004141 advisory. An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data structures...

CVE-2025-71081

In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: sai: fix OF node leak on probe The reference taken to the sync provider OF node when probing the platform device is currently only dropped if the setsync callback fails during DAI probe. Make sure to drop the referen...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002958)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002958 advisory. sound/core/timer.c in the Linux kernel before 4.4.1 uses an incorrect type of mutex, which allows local users to cause a denial of service race condition,...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002783)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002783 advisory. Race condition in the sndpcmperiodelapsed function in sound/core/pcmlib.c in the ALSA subsystem in the Linux kernel before 4.7 allows local users to cause a denial o...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001752)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001752 advisory. A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the...