CVE-2026-80525 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
The ipc_config_data buffer for copier widgets is built once during ipc_prepare (called from sof_pcm_setup_connected_widgets) and cached for reuse. For host copiers this buffer contains the copier_data with gtw_cfg.node_id (host DMA ID). For DAI copiers it additionally includes a dma_config_tlv trailer with stream_id and dma_channel_id for HDA link DMA.
On suspend/resume, both host and link DMA streams are released and re-allocated with potentially different stream tags. The underlying copier_data and dma_config_tlv structures are correctly updated by host_config and sdw_hda_dai_hw_params respectively. However, since the widget list (spcm->stream[].list) persists across suspend,
sof_pcm_hw_params skips sof_pcm_setup_connected_widgets and ipc_prepare never runs again to rebuild ipc_config_data. The stale cached payload is then sent to firmware with boot-time DMA channel assignments, causing DMA channel conflicts that lead to firmware errors and crashes.
Fix this by refreshing copier_data and dma_config_tlv portions of ipc_config_data in sof_ipc4_widget_setup right before the IPC message is sent. This ensures the payload always reflects the current DMA state regardless of whether ipc_prepare ran.
For DAI copiers, the gtw_cfg.config_length in copier_data is temporarily inflated to include the TLV size (matching the ipc_config_data layout) before copying, then restored, mirroring what sof_ipc4_prepare_copier_module does when first building the buffer.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability described involves a state management flaw within the Linux kernel's Advanced System On Chip Sound driver, specifically in the Sound Open Firmware IPC4 topology handling code. This issue manifests as a failure to synchronize cached configuration data with dynamic hardware resource allocations during power state transitions such as suspend and resume cycles. The core of the problem lies in how copier widgets manage their inter-process communication payloads. During initial setup via ipc_prepare, an ipc_config_data buffer is constructed for host and digital audio interface copiers. This buffer encapsulates critical DMA configuration parameters including node identifiers, stream IDs, and channel assignments which are essential for establishing correct data paths between the CPU and peripheral devices.
The operational impact arises from a mismatch between persistent software state structures and volatile hardware resource allocations. When the system enters suspend mode, existing host and link DMA streams are released to free up resources. Upon resumption, these streams are re-allocated by the kernel's dynamic allocator which may assign different stream tags or channel identifiers than those present at boot time. While the underlying data structures representing copier configurations are correctly updated through standard hardware parameterization functions like host_config and sdw_hda_dai_hw_params, a critical disconnect remains in the IPC message preparation logic. The widget list maintained by sof_pcm persists across suspend-resume cycles without triggering a full re-preparation sequence.
Consequently, when audio playback or capture is initiated after resume, the function sof_pcm_hw_params determines that connected widgets do not require setup and skips calling ipc_prepare. This oversight means the stale cached payload containing outdated DMA channel assignments from boot time remains in use. Sending this obsolete configuration to the firmware results in direct conflicts with currently active hardware resources. The firmware attempts to program DMA engines using invalid or conflicting channel IDs, leading to immediate operational failures including firmware errors, audio stream corruption, and potentially system crashes due to unhandled exceptions within the DSP subsystem.
This flaw is best classified under CWE-672 which pertains to the use of operationally obsolete variables, as well as CWE-362 regarding concurrent execution using shared resources with insufficient synchronization. The failure to refresh stateful configuration data before transmission violates fundamental principles of resource lifecycle management in embedded systems interacting with firmware over IPC interfaces. From a threat modeling perspective utilizing MITRE ATT&CK frameworks, this represents an availability impact where improper handling of system transitions leads to service disruption rather than direct exploitation for privilege escalation or data exfiltration.
The resolution involves modifying the sof_ipc4_widget_setup function to explicitly refresh copier_data and dma_config_tlv portions of the ipc_config_data immediately prior to sending IPC messages. This ensures that regardless of whether the initial preparation phase was skipped due to cached widget states, the payload always reflects current DMA allocations. For digital audio interface copiers specifically, the fix temporarily inflates the configuration length field in copier_data to accommodate the TLV trailer size during copy operations, mirroring logic already present in sof_ipc4_prepare_copier_module. This approach guarantees that both host and link DMA configurations are accurately transmitted to firmware with up-to-date channel assignments preventing conflicts and ensuring stable operation across power state transitions.