Description
In the Linux kernel, the following vulnerability has been resolved:

ASoC: fsl_micfil: balance mclk enable/disable

hw_params() enables mclk unconditionally and hw_free() disables it
unconditionally, but the PCM core does not guarantee 1:1 pairing:
hw_free() can run without hw_params(), and hw_params() can be called
multiple times from the SETUP state. This triggers an "already
disabled" WARN() in the first case and leaks an enable reference in
the second, leaving the clock ungateable.

Guard both sides with the existing mclk_flag, as fsl_sai.c does with
mclk_streams.
Published: 2026-09-25
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Assess Impact
AI Analysis

Impact

In the Linux kernel ASoC subsystem the fsl_micfil driver contains a logic flaw where the hardware parameters routine enables the master clock (mclk) without checking its current status, and the corresponding free routine disables it unconditionally. Because these two callbacks are not guaranteed to be called in a 1:1 sequence, a call to hw_free() can occur without a preceding hw_params() and an hw_params() can be invoked repeatedly during the SETUP state. The first scenario triggers a WARN() as the clock is already disabled, while the second scenario leaks an enable reference, causing the clock to remain enabled and ungateable. This resource leak can prevent proper shutdown of the audio hardware and may degrade system stability, effectively serving as a denial‑of‑service vector.

Affected Systems

Affected systems encompass Linux kernel installations that include the fsl_micfil ASoC driver, which is common in certain ARM SoC configurations. No specific kernel version ranges are provided, so all kernel releases with this driver prior to the fix may be vulnerable.

Risk and Exploitability

The EPSS score for this issue is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that no public exploit is known. Nonetheless the bug can be triggered locally by applications that exercise the PCM audio subsystem and could lead to a steady resource leak of the master clock, causing intermittent or permanent loss of audio capability. Because the fault requires code paths within the kernel and no remote exploitation vector is documented, the overall risk remains moderate, though the impact on availability warrants prompt attention if affected hardware is in use.

Generated by OpenCVE AI on September 25, 2026 at 16:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the kernel to the latest stable release that includes the fsl_micfil patch to balance mclk enable/disable handling.
  • If the fsl_micfil driver is not needed for your application, disable or unload the module to remove the risk of leaking mclk references.
  • Monitor system logs for WARN messages indicating an "already disabled" condition, and reboot or reload the driver when such warnings appear to reset the clock state.

Generated by OpenCVE AI on September 25, 2026 at 16:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-399

Fri, 25 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl_micfil: balance mclk enable/disable hw_params() enables mclk unconditionally and hw_free() disables it unconditionally, but the PCM core does not guarantee 1:1 pairing: hw_free() can run without hw_params(), and hw_params() can be called multiple times from the SETUP state. This triggers an "already disabled" WARN() in the first case and leaks an enable reference in the second, leaving the clock ungateable. Guard both sides with the existing mclk_flag, as fsl_sai.c does with mclk_streams.
Title ASoC: fsl_micfil: balance mclk enable/disable
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-25T10:24:25.285Z

Reserved: 2026-09-25T10:19:56.076Z

Link: CVE-2026-98093

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-25T11:17:39.023

Modified: 2026-09-25T11:17:39.023

Link: CVE-2026-98093

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T16:15:16Z

Weaknesses