Description
In the Linux kernel, the following vulnerability has been resolved:

mailbox: mtk-adsp: fix UAF during device teardown

When the SOF audio driver fails to initialize (e.g. firmware boot
timeout), its devres unwind frees the snd_sof_dev object that the
mailbox client (mtk-adsp-ipc) reaches via chan->cl->rx_callback.
The mtk-adsp-mailbox shutdown clears the mailbox command registers
but leaves the IRQ line unmasked, so a late interrupt can still
queue a threaded handler after mbox_free_channel() had cleared
chan->cl, and mbox_chan_received_data() would then trigger UAF:

BUG: KASAN: slab-use-after-free in sof_ipc3_validate_fw_version
sof_ipc3_validate_fw_version
sof_ipc3_do_rx_work
sof_ipc3_rx_msg
mt8196_dsp_handle_request
mtk_adsp_ipc_recv
mbox_chan_received_data
mtk_adsp_mbox_isr
irq_thread_fn
Freed by task ...:
kfree
devres_release_all
really_probe
... (sof-audio-of-mt8196 probe failure)

The crash was observed roughly three seconds after the failed probe.

disable_irq() in shutdown and enable_irq() in startup. disable_irq()
also waits for any in-flight interrupts, so by the time
mbox_free_channel() proceeds to clear chan->cl no rx_callback can run.

In addition, request the IRQ with IRQF_NO_AUTOEN so it stays masked
between probe and the first client bind — otherwise an early interrupt
can crash on chan->cl == NULL in mbox_chan_received_data().
Published: 2026-08-15
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a use‑after‑free bug in the mtk‑adsp mailbox path of the Linux kernel. When the SOF audio driver fails to initialize, its cleanup frees the snd_sof_dev object while the mailbox client’s IRQ handler remains enabled. A late interrupt can then invoke the reclaimed channel pointer, causing the kernel to dereference freed memory. The kernel reports a KASAN slab‑use‑after‑free and crashes, which is a kernel‑level vulnerability. This weakness is classified as CWE‑825.

Affected Systems

The defect affects Linux kernel releases that include the MediaTek ADSP mailbox driver and support MediaTek SoCs such as the MT8196. Any distribution kernel that has not applied the patch commit that introduced the UAF fix is vulnerable.

Risk and Exploitability

The exploit requires a scenario where the SOF audio driver fails to load, which can be triggered by firmware timeouts or corrupted firmware images. While the bug manifests only after a device teardown, an attacker with local or privileged access can provoke the failure. The CVSS score is 5.5, reflecting a medium severity. The EPSS score is < 1% and the issue is not listed in KEV, but the use‑after‑free still represents a kernel‑level risk.

Generated by OpenCVE AI on August 18, 2026 at 05:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes the patch that fixes the mtk‑adsp mailbox use‑after‑free bug.
  • If an upgrade is not immediately possible, blacklist the "sof" kernel module or otherwise disable the SOF audio subsystem to avoid the faulty teardown path.
  • Configure any remaining SOF audio components to request IRQs with the IRQF_NO_AUTOEN flag so that interrupts are masked until full initialization.

Generated by OpenCVE AI on August 18, 2026 at 05:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Tue, 18 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sat, 15 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize (e.g. firmware boot timeout), its devres unwind frees the snd_sof_dev object that the mailbox client (mtk-adsp-ipc) reaches via chan->cl->rx_callback. The mtk-adsp-mailbox shutdown clears the mailbox command registers but leaves the IRQ line unmasked, so a late interrupt can still queue a threaded handler after mbox_free_channel() had cleared chan->cl, and mbox_chan_received_data() would then trigger UAF: BUG: KASAN: slab-use-after-free in sof_ipc3_validate_fw_version sof_ipc3_validate_fw_version sof_ipc3_do_rx_work sof_ipc3_rx_msg mt8196_dsp_handle_request mtk_adsp_ipc_recv mbox_chan_received_data mtk_adsp_mbox_isr irq_thread_fn Freed by task ...: kfree devres_release_all really_probe ... (sof-audio-of-mt8196 probe failure) The crash was observed roughly three seconds after the failed probe. disable_irq() in shutdown and enable_irq() in startup. disable_irq() also waits for any in-flight interrupts, so by the time mbox_free_channel() proceeds to clear chan->cl no rx_callback can run. In addition, request the IRQ with IRQF_NO_AUTOEN so it stays masked between probe and the first client bind — otherwise an early interrupt can crash on chan->cl == NULL in mbox_chan_received_data().
Title mailbox: mtk-adsp: fix UAF during device teardown
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:15:36.888Z

Reserved: 2026-08-09T03:40:39.936Z

Link: CVE-2026-72486

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:22.860

Modified: 2026-08-17T06:19:16.810

Link: CVE-2026-72486

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72486 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T05:45:03Z

Weaknesses
  • CWE-825

    Expired Pointer Dereference