CVE-2026-43459

In the Linux kernel, the following vulnerability has been resolved:

ASoC: soc-core: flush delayed work before removing DAIs and widgets

When a sound card is unbound while a PCM stream is open, a

use-after-free can occur in snd_soc_dapm_stream_event(), called from

the close_delayed_work workqueue handler.

During unbind, snd_soc_unbind_card() flushes delayed work and then

calls soc_cleanup_card_resources(). Inside cleanup,

snd_card_disconnect_sync() releases all PCM file descriptors, and

the resulting PCM close path can call snd_soc_dapm_stream_stop()

which schedules new delayed work with a pmdown_time timer delay.

Since this happens after the flush in snd_soc_unbind_card(), the

new work is not caught. soc_remove_link_components() then frees

DAPM widgets before this work fires, leading to the use-after-free.

The existing flush in soc_free_pcm_runtime() also cannot help as it

runs after soc_remove_link_components() has already freed the widgets.

Add a flush in soc_cleanup_card_resources() after

snd_card_disconnect_sync() (after which no new PCM closes can

schedule further delayed work) and before soc_remove_link_dais()

and soc_remove_link_components() (which tear down the structures the

delayed work accesses).