CVE-2026-53350: Linux Kernel wm_adsp NULL Pointer Dereference Audio Driver Crash

Technical summary

CVE-2026-53350 is a NULL pointer dereference vulnerability in the Linux kernel's ASoC (ALSA System on Chip) Wolfson microelectronics DSP driver module (wm_adsp). The flaw exists in the wm_adsp_control_remove() function, which fails to validate that the cs_ctl->priv pointer is non-NULL before dereferencing it during control cleanup. The vulnerability manifests when cs_dsp_remove() iterates through its control list and invokes wm_adsp_control_remove() for controls where private data was never initialized—specifically SYSTEM-type controls and controls hidden by codec driver callbacks that prevent wm_adsp_control_add() from executing. The missing NULL check allows kernel memory access violations, resulting in an oops and denial of service.

Business impact

This vulnerability poses a localized denial-of-service risk to systems with audio hardware using the affected Wolfson microelectronics DSP chipsets. On affected devices, unloading audio drivers or performing system audio reinitialization could trigger a kernel panic, disrupting audio services and potentially requiring manual intervention or reboot. For environments where audio processing is critical—such as multimedia servers, embedded audio systems, or IoT devices with audio capabilities—unexpected crashes reduce reliability and increase operational overhead. The attack surface is limited to local users with driver load/unload privileges, so remote exploitation is not feasible.

Affected systems

The vulnerability affects Linux kernel installations that include ASoC support for Wolfson microelectronics DSP audio processors. This includes systems with WM8993, WM8994, WM1811, WM5110, WM8280, and related Wolfson audio codec variants. Affected kernel versions are those containing the vulnerable wm_adsp code prior to the fix. Desktop and server distributions using these audio codecs, as well as embedded Linux systems (such as automotive infotainment, industrial IoT, and consumer audio devices) with Wolfson audio hardware, are in scope. Check your system's kernel configuration and loaded audio drivers to determine exposure.

Exploitability

Exploitation requires local system access and the ability to trigger audio driver unload or control cleanup operations. An unprivileged user with basic system access may induce the crash by unloading the audio driver module (if module unloading is permitted) or by causing audio subsystem reinitialization through standard interfaces. The vulnerability is reliable and deterministic once the conditions are met, but cannot be remotely exploited. Physical or administrative access, or compromise of a user account with driver privileges, is a prerequisite. The CVSS score of 5.5 reflects the local-only attack vector, low complexity, and availability-only impact.

Remediation

The fix involves adding a NULL pointer check in wm_adsp_control_remove() before dereferencing cs_ctl->priv. This is a minimal, surgical patch that prevents kernel memory access violations. Administrators should update to a patched Linux kernel version that includes the fix for CVE-2026-53350. Verify the specific kernel version addressing this issue against your distribution's security advisories, as version numbers vary across vendors.

Patch guidance

Apply the latest security-updated kernel from your Linux distribution. Check your vendor's security advisory or kernel release notes to confirm that your target kernel version includes the fix for CVE-2026-53350. For distributions offering stable backports, apply the ASoC/wm_adsp patch to your current kernel branch if upgrading is not immediately possible. Test audio functionality after patching to ensure driver loading and unloading work without errors. If your system does not use Wolfson audio hardware, verify that wm_adsp is not compiled into your kernel; disabling it via kernel configuration will eliminate exposure.

Detection guidance

Monitor kernel logs for NULL pointer dereference oops messages originating from wm_adsp_control_remove() in the audio subsystem. Use dmesg or systemd journal to capture crash details. If audio drivers are unloaded or reloaded frequently, watch for corresponding kernel panics or driver load failures. Systems can be scanned to determine if CONFIG_SND_SOC_WM_ADSP is enabled in the running kernel and whether Wolfson audio hardware is present. Intrusion detection systems can flag unusual audio driver manipulation or repeated audio subsystem failures as potential exploitation attempts.

Why prioritize this

While the CVSS score of 5.5 (MEDIUM) reflects the local-only attack vector and availability impact, prioritization depends on your environment. Organizations with audio-critical systems (media streaming, VoIP, multimedia workstations) or systems where audio driver reloads are routine should patch sooner. Conversely, systems without Wolfson audio hardware have zero risk and can defer patching. The vulnerability is not currently tracked in the CISA KEV catalog, indicating limited real-world active exploitation. Prioritize based on asset criticality and whether Wolfson audio hardware is actually deployed.

Risk score, explained

The CVSS v3.1 score of 5.5 is derived from: Local attack vector (no network access required), Low attack complexity (straightforward trigger via driver unload), Low privileges required (unprivileged user can trigger), No user interaction needed, and high availability impact (kernel crash/DoS). Confidentiality and integrity are unaffected—only the availability of audio services is at risk. The score appropriately reflects a localized, non-remote denial-of-service condition.

Frequently asked questions