CVE-2026-72486

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the mtk-adsp mailbox component during device teardown. When the SOF audio driver fails to initialize, the snd sof dev object is freed. However, because the mtk-adsp-mailbox shutdown process leaves the IRQ line unmasked, a late interrupt can trigger a threaded handler. This leads to a UAF when mbox chan received data() is called after mbox free channel() has already cleared the chan->cl reference. The issue involves the following functions: sof ipc3 validate fw version(), sof ipc3 do rx work(), sof ipc3 rx msg(), mt8196 dsp handle request(), mtk adsp ipc recv(), mbox chan received data(), and mtk adsp mbox isr(). Additionally, if the IRQ is not requested with IRQF NO AUTOEN, an early interrupt can cause a crash when chan->cl is NULL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.