CVE-2026-72486

A flaw was found in the Linux kernel's mtk-adsp mailbox driver. During device teardown, if the Sound Open Firmware (SOF) audio driver fails to initialize, a timing issue can occur where an interrupt is processed after the associated memory has been released. This Use-After-Free (UAF) vulnerability can lead to a system crash, resulting in a Denial of Service (DoS).

A use-after-free flaw was found in the Linux kernel's mtk-adsp mailbox driver, which Red Hat Product Security rates as Moderate security impact. If the Sound Open Firmware (SOF) audio driver fails to initialize (for example, due to a firmware boot timeout), its device-resource cleanup frees the snd_sof_dev object that the mtk-adsp mailbox client reaches through its receive callback, while the mailbox shutdown path leaves the interrupt line unmasked. A late interrupt can then queue a threaded handler after the mailbox channel client pointer has been cleared, causing mbox_chan_received_data() to dereference the already-freed memory. The consequence is a kernel crash, resulting in a denial of service; there is no impact on confidentiality or integrity. The issue is limited to local systems that contain the vulnerable MediaTek ADSP mailbox driver and is triggered only when the audio driver fails to probe and the device is torn down. Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected by this flaw because the vulnerable code is not present in the shipped kernel packages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.