CVE-2026-80911

A flaw was found in the Linux kernel's ASoC Sound Open Firmware (SOF) audio subsystem. An error in the sof_widget_setup_unlocked() function could lead to a double decrement of a widget's use count and a double invocation of core_put() during widget setup failure. This resource mismanagement could result in system instability or a denial of service.

ASoC/SOF widget setup has an error path where sof_widget_free_unlocked() may be called and then execution can fall through into additional cleanup, causing a second use_count decrement and a second core_put(). This is a reference or lifetime accounting bug in kernel audio topology setup and may leave widget or DSP core state inconsistent after a setup failure. For the CVSS the PR:L is used for the paranoid interpretation because a local user or delegated audio service may be able to influence audio topology setup or recovery paths in some deployments, even though typical direct control is administrative. The issue is not network reachable and requires local interaction with the audio driver stack or a failing topology setup path. Impact is at least local denial of service or audio subsystem failure. In the worst still defensible case it may allow limited confidentiality or integrity impact through corrupted lifetime accounting and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.