GHSA-7XG7-8G6Q-847F
Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-15 06:32In the Linux kernel, the following vulnerability has been resolved:
mailbox: mtk-adsp: fix UAF during device teardown
When the SOF audio driver fails to initialize (e.g. firmware boot timeout), its devres unwind frees the snd_sof_dev object that the mailbox client (mtk-adsp-ipc) reaches via chan->cl->rx_callback. The mtk-adsp-mailbox shutdown clears the mailbox command registers but leaves the IRQ line unmasked, so a late interrupt can still queue a threaded handler after mbox_free_channel() had cleared chan->cl, and mbox_chan_received_data() would then trigger UAF:
BUG: KASAN: slab-use-after-free in sof_ipc3_validate_fw_version sof_ipc3_validate_fw_version sof_ipc3_do_rx_work sof_ipc3_rx_msg mt8196_dsp_handle_request mtk_adsp_ipc_recv mbox_chan_received_data mtk_adsp_mbox_isr irq_thread_fn Freed by task ...: kfree devres_release_all really_probe ... (sof-audio-of-mt8196 probe failure)
The crash was observed roughly three seconds after the failed probe.
disable_irq() in shutdown and enable_irq() in startup. disable_irq() also waits for any in-flight interrupts, so by the time mbox_free_channel() proceeds to clear chan->cl no rx_callback can run.
In addition, request the IRQ with IRQF_NO_AUTOEN so it stays masked between probe and the first client bind — otherwise an early interrupt can crash on chan->cl == NULL in mbox_chan_received_data().
{
"affected": [],
"aliases": [
"CVE-2026-72486"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-15T06:22:22Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mtk-adsp: fix UAF during device teardown\n\nWhen the SOF audio driver fails to initialize (e.g. firmware boot\ntimeout), its devres unwind frees the snd_sof_dev object that the\nmailbox client (mtk-adsp-ipc) reaches via chan-\u003ecl-\u003erx_callback.\nThe mtk-adsp-mailbox shutdown clears the mailbox command registers\nbut leaves the IRQ line unmasked, so a late interrupt can still\nqueue a threaded handler after mbox_free_channel() had cleared\nchan-\u003ecl, and mbox_chan_received_data() would then trigger UAF:\n\n BUG: KASAN: slab-use-after-free in sof_ipc3_validate_fw_version\n sof_ipc3_validate_fw_version\n sof_ipc3_do_rx_work\n sof_ipc3_rx_msg\n mt8196_dsp_handle_request\n mtk_adsp_ipc_recv\n mbox_chan_received_data\n mtk_adsp_mbox_isr\n irq_thread_fn\n Freed by task ...:\n kfree\n devres_release_all\n really_probe\n ... (sof-audio-of-mt8196 probe failure)\n\nThe crash was observed roughly three seconds after the failed probe.\n\ndisable_irq() in shutdown and enable_irq() in startup. disable_irq()\nalso waits for any in-flight interrupts, so by the time\nmbox_free_channel() proceeds to clear chan-\u003ecl no rx_callback can run.\n\nIn addition, request the IRQ with IRQF_NO_AUTOEN so it stays masked\nbetween probe and the first client bind \u2014 otherwise an early interrupt\ncan crash on chan-\u003ecl == NULL in mbox_chan_received_data().",
"id": "GHSA-7xg7-8g6q-847f",
"modified": "2026-08-15T06:32:26Z",
"published": "2026-08-15T06:32:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72486"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/25d6ea6c76e1b1b7c57337b2f8f1b6fc8d5c52bc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7d881615fb6373f71fc628b3f00186aeca87a3d5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b57d1a40bc43258372fa1f4d39305e093947a262"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b6337a08a63eef8efcffe3c01d479badda6bbbdb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e519c1d8c5efb5cd8d4c5bb3fe39b1bbb812bdb9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fc6c3deb1d4c0adebf7dee0b8af4082af3f17690"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.