Linux Kernel CVE-2026-43204

Exploitation requires: (1) local access to a Linux system built on Qualcomm SoC hardware with the Q6ASM/ASoC Qualcomm audio driver compiled and loaded; (2) low-privilege local account with access to ALSA audio devices (typically membership in the 'audio' group or equivalent); (3) ability to open and close audio data streams in a timing window where DSP asynchronous responses are in-flight at the moment of stream closure. Systems without Qualcomm audio hardware, or kernels compiled without CONFIG_SND_SOC_QCOM, are not exploitable. Remote exploitation is not possible - AV:L in CVSS confirms strictly local access. Containerized environments that do not expose audio device nodes to the container are not exploitable from within the container. The race timing dependency (AC:L despite being a race) suggests the window is wide enough to be reliably triggered without special tooling.

Real-world risk is constrained significantly by exploitation conditions. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H correctly reflects a local, low-privilege denial-of-service with no confidentiality or integrity impact - a system lockup, not arbitrary code execution. EPSS at 0.02% (5th percentile) corroborates low exploitation interest, and the vulnerability is absent from CISA KEV. The hardware dependency is the primary risk limiter: exploitation requires a Linux system running on Qualcomm SoC hardware with the Q6ASM driver active - this excludes x86 servers, AMD-based systems, and non-Qualcomm ARM platforms entirely. The 'Information Disclosure' tag present in the source intelligence appears inconsistent with the CVSS C:N metric and the description, which describes only lockups; this tag should be treated as erroneous or unverified. Priority should be moderate for Qualcomm-based Linux fleets (embedded, mobile, ARM laptops) and low-to-negligible for server or x86 environments.

A local user on a Qualcomm SoC-based Linux system (such as an ARM laptop or embedded device) opens an audio stream via the ALSA/Q6ASM interface, then rapidly closes it while DSP response messages are still in-flight from the Qualcomm Hexagon DSP. The kernel's Q6ASM response handler processes the stale response against the now-closed stream context, triggering a lockup that hangs the affected kernel thread or causes a system-wide deadlock. No public proof-of-concept exploit is known at time of analysis.