Linux Kernel Vulnerability in wm_adsp Firmware Control Management

CVE-2026-53350

What is CVE-2026-53350?

A vulnerability in the Linux kernel's wm_adsp module has been identified where a NULL dereference occurs in the wm_adsp_control_remove() function. This issue arises when the cs_dsp attempts to clean up private control data associated with an Audio Stream Control (ASoC) but does not verify that the private data pointer is not NULL. If the control is a SYSTEM control or if the codec driver has registered a callback that obscures the control, the private data may not exist when cleanup is attempted, leading to potential system instability and crashes. Efficient management of firmware control data is crucial for maintaining the robustness of audio systems.

References