What’s Vulnerable › Vulnerabilities

CVE-2026-43204: ASoC: qcom: q6asm: drop DSP responses for closed data streams

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-06 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6asm: drop DSP responses for closed data streams 'Commit a354f030dbce ("ASoC: qcom: q6asm: handle the responses after closing")' attempted to ignore DSP responses arriving after a stream had been closed. However, those responses were still handled, causing lockups. Fix this by unconditionally dropping all DSP responses associated with closed data streams.

Affected products

• Linux kernel: from 4.18 before 6.19.6 — fixed in 6.19.6
• Linux: 4.18 — fixed in 7.0

How to fix

Upgrade to a fixed version: Linux kernel 6.19.6; Linux 7.0. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/3249251eac6081d5169ba09f2d9cca66ab0cab0d
• https://git.kernel.org/stable/c/3a409a64b2d61430c63cbb15d51681f13b8b0acd
• https://git.kernel.org/stable/c/414396c42ef20d2d0c9213adaf4dfa59490ca077
• https://git.kernel.org/stable/c/750b468d8e0ba0ba1774a0da55b950dc23ffda67
• https://git.kernel.org/stable/c/8a066a81ee0c1b6cdbd81393536c3b2d19ccef25
• https://git.kernel.org/stable/c/c0b69245263ffa3db6f1be6e068528578fde635b

Get alerted when CVE-2026-43204 or the next vulnerability affects your stack