Skip to main content

Linux Kernel EUVDEUVD-2026-27763

| CVE-2026-43204 MEDIUM
2026-05-06 Linux GHSA-c79v-q7h2-4c95
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access to Qualcomm audio hardware required (AV:L, PR:L); pure availability lockup with no confidentiality or integrity impact (C:N, I:N, A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:02 vuln.today
CVSS changed
May 11, 2026 - 20:07 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ASoC: qcom: q6asm: drop DSP responses for closed data streams

'Commit a354f030dbce ("ASoC: qcom: q6asm: handle the responses after closing")' attempted to ignore DSP responses arriving after a stream had been closed.

However, those responses were still handled, causing lockups.

Fix this by unconditionally dropping all DSP responses associated with closed data streams.

AnalysisAI

Kernel lockup in the Qualcomm Q6ASM (Audio Stream Manager) driver allows a local low-privileged user to trigger a system hang by racing audio stream closure against in-flight DSP responses. Affected Linux kernel versions spanning from the initial commit (1da177e4c3f4) up to the stable fixes in 6.19.6 and 7.0 are vulnerable. A prior partial fix (commit a354f030dbce) attempted to suppress post-close DSP response handling but failed to prevent processing, leaving the lockup reachable. No public exploit code exists and no active exploitation has been confirmed - EPSS sits at 0.02% (5th percentile), consistent with a niche hardware-dependent kernel DoS.

Technical ContextAI

The vulnerability resides in the ASoC (ALSA System on Chip) subsystem, specifically the Qualcomm Q6ASM driver (drivers/soc/qcom/q6asm), which manages audio streams between the Linux CPU and the Qualcomm Hexagon DSP. When a userspace application closes an audio data stream, the DSP may still deliver queued response messages asynchronously. A previous fix (commit a354f030dbce) attempted to handle this race by detecting closed-stream responses and ignoring them, but the response handling path was still executed, creating a deadlock or lockup condition - likely due to lock acquisition on an invalidated or freed stream object. The correct fix unconditionally drops all DSP responses tied to closed data streams. CWE data is absent from the source, but the root cause aligns with CWE-667 (Improper Locking) or CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization). CPE data identifies the affected product as cpe:2.3:a:linux:linux:*.

RemediationAI

The primary remediation is to update the Linux kernel to version 6.19.6 or 7.0, which contain the upstream fix available at https://git.kernel.org/stable/c/8a066a81ee0c1b6cdbd81393536c3b2d19ccef25 and https://git.kernel.org/stable/c/3249251eac6081d5169ba09f2d9cca66ab0cab0d. For Red Hat and SUSE deployments, apply the vendor-provided kernel errata once released. If kernel upgrade is not immediately feasible on Qualcomm-based systems, a compensating control is to restrict access to audio devices (e.g., remove users from the 'audio' group, tighten /dev/snd/* permissions) to reduce the set of principals who can open and close Q6ASM streams - note this disables audio functionality for those users. Alternatively, unloading the snd_soc_qcom_q6asm kernel module (if modular) removes the vulnerable code path but eliminates Qualcomm DSP audio entirely. Neither workaround addresses the root cause; kernel patching remains the definitive fix.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27763 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy