CVE-2026-53052

A flaw was found in the Linux kernel. The Advanced Linux Sound Architecture on Chip (ASoC) subsystem, specifically within the Qualcomm qdsp6 topology component, fails to verify the type of a virtual widget before accessing its private data. This oversight could allow an attacker to cause incorrect memory access, potentially leading to a denial of service (DoS) condition.

ASoC qcom qdsp6 topology unload can access dobj private as an audioreach_module before checking whether the widget is a virtual mixer. For a virtual widget the same private pointer may actually refer to snd_ar_control, so the early mod container read is a type confusion style invalid memory access and can also become a NULL pointer dereference if the private pointer is absent. For the CVSS the PR:L is used for the paranoid view because a local untrusted process may be able to reach this path through delegated audio service or device management contexts, while the common base case is closer to PR:H. The issue is not network reachable. Impact is at least local denial of service via kernel warning or crash, with limited confidentiality or integrity impact only in the paranoid view because the primitive is an invalid read rather than an arbitrary write.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.