CVE-2026-80581 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
Ignore IPC errors for pipeline state change if the firmware state is crashed or the IPC has timed out.
If the firmware has crashed the kernel still needs to go through the state changes to reset its internal to be able to correctly work the next time the DSP is booted up.
The case with IPC timeout is a bit more problematic, but it has been rootcaused to be the result of system scheduling blockage and the firmware did actually received and handled the message, but the reply handling got blocked by issues outside of the SOF stack. So far the best way to handle this is to continue with setting the state.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel's Sound Open Firmware subsystem contains a logic flaw in the pipeline trigger mechanism that can lead to improper state management during firmware crashes or communication timeouts. Specifically, within the ipc4-pcm module, the system previously halted processing when an Inter-Processor Communication error occurred. This rigid behavior prevented the operating system from correctly resetting its internal state representations after a DSP firmware crash. When the firmware becomes unresponsive due to a crash, it is critical for the kernel to continue executing state transition routines. Without this continuation, the kernel's view of the audio subsystem remains inconsistent with reality, potentially causing subsequent operations on that hardware path to fail or behave unpredictably until a full system reboot occurs.
The vulnerability also addresses scenarios involving IPC timeouts where the firmware has actually processed the command but failed to send a reply due to external scheduling blockages rather than actual communication failure. In these cases, treating the timeout as an error condition incorrectly aborts the pipeline trigger process. By ignoring specific IPC errors related to state changes when either a crash is detected or a timeout occurs under known conditions, the kernel ensures that internal data structures are updated correctly. This adjustment allows the audio subsystem to recover gracefully and function properly in subsequent interactions with the DSP without requiring manual intervention or system restarts.
From a security and reliability perspective, this issue aligns with CWE-406, which describes insufficient control of resource consumption through improper state management, although it is primarily classified as a stability defect rather than an exploitable vulnerability. The flaw impacts availability by potentially leaving the audio subsystem in a broken state that requires administrative action to resolve. It does not directly facilitate privilege escalation or data exfiltration but degrades system reliability and user experience for applications relying on real-time audio processing.
Mitigation involves applying the upstream kernel patch that modifies the error handling logic in the ASoC SOF ipc4-pcm driver. System administrators should ensure their kernels are updated to include this fix, which is typically available through standard distribution security updates or by compiling a newer mainline Linux kernel version. Regular monitoring of system logs for DSP-related errors can help identify instances where such state inconsistencies might have occurred prior to the patch application.