Skip to main content

Linux Kernel EUVDEUVD-2026-38920

| CVE-2026-53052 MEDIUM
2026-06-24 Linux GHSA-7vqx-9fw3-998v
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local driver path requires authenticated local user; no confidentiality or integrity impact confirmed; kernel crash yields High availability loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 21, 2026 - 17:38 vuln.today
CVSS changed
Jul 21, 2026 - 17:37 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:29 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ASoC: qcom: qdsp6: topology: check widget type before accessing data

Check widget type before accessing the private data, as this could a virtual widget which is no associated with a dsp graph, container and module. Accessing witout check could lead to incorrect memory access.

AnalysisAI

Incorrect memory access in the Linux kernel's ASoC Qualcomm QDSP6 audio topology driver can trigger a kernel panic on affected Qualcomm Snapdragon hardware when virtual DAPM widgets are processed without a type guard. The flaw, introduced at commit 36ad9bf1d93d66b901342eab9f8ed6c1537655a6, affects kernel branches from 5.16 onward until the respective stable fixes. No active exploitation has been identified (not in CISA KEV) and the EPSS score of 0.17% (7th percentile) reflects negligible real-world exploitation probability; hardware dependency further constrains the affected population.

Technical ContextAI

The vulnerability resides in the ASoC (ALSA System on Chip) QCOM QDSP6 audio topology driver, which maps ALSA DAPM (Dynamic Audio Power Management) widgets to Qualcomm DSP graph nodes, containers, and modules on Snapdragon SoCs. When the topology code iterates over widgets, it accesses the widget's private data pointer - which references DSP-specific metadata - without first verifying the widget type. Virtual widgets, which exist in the DAPM graph as logical constructs and carry no associated DSP graph or container, have no valid private data. Accessing that pointer unconditionally results in a null or stale pointer dereference, corrupting or reading invalid kernel memory. Although CWE is listed as N/A by NVD, the root cause class aligns with CWE-476 (NULL Pointer Dereference) or CWE-843 (Type Confusion). The affected CPE is cpe:2.3:a:linux:linux scoped to the specific commit range.

RemediationAI

Update to a fixed kernel version: 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1. Ubuntu users should apply the patches described in USN-8568-1 (https://ubuntu.com/security/notices/USN-8568-1), USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1), or USN-8566-1 (https://ubuntu.com/security/notices/USN-8566-1). Upstream stable fix commits are available at https://git.kernel.org/stable/c/8e8cd78b6000c9d19db249a5a68287158f288ef3 and related references. If immediate patching is not feasible on Snapdragon hardware, blacklisting the relevant QDSP6 ASoC kernel modules (e.g., snd-soc-qcom-common or the platform-specific topology module) via /etc/modprobe.d will eliminate the attack surface but will disable audio functionality entirely - this trade-off is acceptable only in headless or audio-unnecessary deployments. Kernel live-patching (kpatch, livepatch) may be applicable for distributions that support it on arm64 targets.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.168 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.149 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.197 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.145 Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected

Share

EUVD-2026-38920 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy