Linux Kernel CVE-2026-53348

Exploitation requires local access with at minimum standard (non-root) user privileges (CVSS PR:L), though the triggering condition is typically an automated kernel event rather than a direct user action. The specific prerequisites are: (1) the target system must have SoundWire SDCA-capable audio hardware (e.g., Intel Panther Lake SoC); (2) the SOF audio firmware for that hardware must be absent, corrupted, or mismatched, causing the snd_sof driver probe to fail; and (3) the kernel must be running an unpatched version containing the vulnerable SDCA cleanup code. The crash occurs during driver cleanup after probe failure - it can be triggered by rebooting without firmware present or by manually unbinding the driver. Limiting factors include the niche hardware requirement (SoundWire SDCA is not present on most servers or older consumer hardware) and the dependency on firmware availability. Remote exploitation is not possible given AV:L.

The CVSS 3.1 score of 5.5 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects the threat model: exploitation is entirely local, requires only standard user-level privileges, has no confidentiality or integrity impact, but produces a high-severity availability outcome (kernel panic). EPSS at 0.14% (4th percentile) is consistent with a hardware-specific, locally-triggered kernel crash that is unlikely to be exploited opportunistically. The vulnerability is not listed in CISA KEV, and no public exploit or proof-of-concept code has been identified at time of analysis. Real-world risk is constrained to systems with SoundWire SDCA-capable audio hardware (e.g., Intel Panther Lake platforms) where the SOF audio driver may encounter probe failures due to missing firmware. For affected hardware, the risk of accidental triggering during boot or driver reload may actually exceed that of deliberate exploitation. Organizations running affected kernel versions on modern Intel laptop hardware should prioritize patching, but this is not a broadly exploitable remote attack.

A local user on a system equipped with SoundWire SDCA audio hardware - such as an Intel Panther Lake laptop - where SOF audio firmware is absent or corrupted causes the kernel's SOF audio driver to fail during probe. As the kernel unwinds the failed driver initialization through the devres cleanup chain, sdca_dev_unregister_functions() iterates over partially-populated func_dev arrays, dereferences a NULL pointer inside device_del(), and triggers a kernel oops that crashes the system. In practice this scenario can arise organically from missing firmware during a fresh OS install, without any deliberate attacker action.