CVE-2026-80525

A flaw was found in the Linux kernel's Sound Open Firmware (SOF) IPC4 topology component. During suspend and resume operations, the system fails to refresh the Inter-Process Communication (IPC) payload for audio copier widgets. This oversight causes outdated Direct Memory Access (DMA) channel assignments to be sent to the firmware. Consequently, this can lead to DMA channel conflicts, resulting in firmware errors and system crashes, effectively causing a Denial of Service (DoS).

A low impact denial of service flaw was found in the Linux kernel Sound Open Firmware (SOF) IPC4 topology component. The IPC payload (ipc_config_data) for audio copier widgets is built once during widget preparation and cached for reuse. After a suspend/resume cycle, host and HDA link DMA streams are released and re-allocated, potentially with different stream tags, but the cached payload is not rebuilt because the widget list persists across suspend. This stale payload, which still carries boot-time DMA channel assignments, is then sent to the audio firmware, which can cause DMA channel conflicts leading to firmware errors and crashes. A local, low-privileged user able to exercise audio streams together with system suspend/resume could use this flaw to crash the audio firmware, resulting in denial of service; there is no impact on confidentiality or integrity. Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS 2 contain the code that introduced this flaw and are marked affected, with the fix deferred because of the low security impact; the residual risk is a local denial of service limited to the audio subsystem on affected SOF-based platforms. Red Hat Enterprise Linux 6, 7, and 8, and the Red Hat Enterprise Linux 9.2 and 9.4 update streams, do not contain the introducing code and are not affected. Although the Red Hat CVSS:3.1 score for this flaw is 5.5 (Moderate), the overall Red Hat impact is rated Low because reliable exploitation depends on specific timing during suspend/resume cycles and the consequence is limited to availability of the audio subsystem.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.