{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-53348","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-06-09T07:44:35.399Z","datePublished":"2026-07-01T13:32:26.850Z","dateUpdated":"2026-07-01T13:32:26.850Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-07-01T13:32:26.850Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions\n\nsdca_dev_unregister_functions() iterates over all SDCA function\ndescriptors and calls sdca_dev_unregister() on each func_dev without\nchecking for NULL. When a function registration has failed partway\nthrough, or the device cleanup races with probe deferral, func_dev\nentries may be NULL, leading to a kernel oops:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000040\n  RIP: 0010:device_del+0x1e/0x3e0\n  Call Trace:\n   sdca_dev_unregister_functions+0x37/0x60 [snd_soc_sdca]\n   release_nodes+0x35/0xb0\n   devres_release_all+0x90/0x100\n   device_unbind_cleanup+0xe/0x80\n   device_release_driver_internal+0x1c1/0x200\n   bus_remove_device+0xc6/0x130\n   device_del+0x161/0x3e0\n   device_unregister+0x17/0x60\n   sdw_delete_slave+0xb6/0xd0 [soundwire_bus]\n   sdw_bus_master_delete+0x1e/0x50 [soundwire_bus]\n   ...\n   sof_probe_work+0x19/0x30 [snd_sof]\n\nThis was observed on a Lenovo ThinkPad X1 Carbon G14 (Panther Lake)\nwith the SOF audio driver probe failing due to missing Panther Lake\nfirmware, causing the subsequent cleanup of SoundWire devices to\ntrigger the crash.\n\nFix this with three changes:\n\n1) Add a NULL guard in sdca_dev_unregister() so that callers do not\n   need to pre-validate the pointer (defense in depth).\n\n2) In sdca_dev_unregister_functions(), skip NULL func_dev entries\n   and clear func_dev to NULL after unregistration, making the\n   function idempotent and safe against double-invocation.\n\n3) In sdca_dev_register_functions(), roll back all previously\n   registered functions when a later one fails, so the function\n   array is never left in a partially-populated state."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/sdca/sdca_function_device.c"],"versions":[{"version":"4496d1c65bad7a3a32d2e09aaf3c54bc562c3fcc","lessThan":"9a4895059bb6a8505098a9f75de187fd15631fc8","status":"affected","versionType":"git"},{"version":"4496d1c65bad7a3a32d2e09aaf3c54bc562c3fcc","lessThan":"e4c60a1d4b6ccc66aefb3789cd908d4f9482eefd","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/sdca/sdca_function_device.c"],"versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","status":"unaffected","versionType":"semver"},{"version":"7.0.13","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.0.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/9a4895059bb6a8505098a9f75de187fd15631fc8"},{"url":"https://git.kernel.org/stable/c/e4c60a1d4b6ccc66aefb3789cd908d4f9482eefd"}],"title":"ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions","x_generator":{"engine":"bippy-1.2.0"}}}}