CVE-2026-53052

The ASoC QDSP6 topology driver in the Linux kernel fails to validate the widget type before accessing its private data. If the widget is virtual or otherwise not linked to a DSP graph, container, or module, the driver may read or write memory that does not belong to the structure. This unchecked conversion can corrupt kernel memory, potentially leading to a kernel panic, data corruption, or other unintended behavior. The weakness is classified as CWE‑843, which describes unsafe type conversion and can result in memory corruption when data is incorrectly handled.

Any Linux distribution that incorporates the ASoC QDSP6 topology code in its kernel is potentially vulnerable. No specific kernel versions are listed, so every build that contains this subsystem could be affected, regardless of the distribution or patch level.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is reported as < 1 %, implying that public exploitation is unlikely. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack likely requires local privilege or the ability to deliver malformed audio topology data to the driver, such as through a malicious application or driver update.