PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43478 Linux CVE debrief

CVE-2026-43478 is a Linux kernel vulnerability in the ASoC rt1011 codec control path. According to the supplied record, the issue was resolved by changing rt1011_recv_spk_mode_put() to obtain the DAPM context from the component with snd_soc_component_to_dapm(), because the kcontrol path can yield a NULL pointer. In practical defensive terms, this is a kernel stability bug in audio codec handling that could lead to a NULL pointer dereference and service disruption if reached.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-13
Original CVE updated
2026-06-26
Advisory published
2026-05-13
Advisory updated
2026-06-26

Who should care

Linux kernel maintainers, distro security teams, embedded Linux vendors, and operators of systems that use the rt1011 ASoC codec path should care. It is especially relevant for devices where audio stack stability matters and kernel updates are tightly managed.

Technical summary

The supplied description says rt1011_recv_spk_mode_put() used the wrong helper to retrieve the DAPM context. The correct approach is snd_soc_component_to_dapm(), not a kcontrol-derived pointer, because the kcontrol path may provide NULL. The bug is therefore a kernel-side pointer handling error in the ASoC codec control flow, with likely impact limited to crash/instability rather than data exposure based on the provided corpus.

Defensive priority

Medium. The record does not include a CVSS score or vector, but the issue is in kernel code and can affect system availability. Kernel fixes should be prioritized for any affected builds that include the rt1011 codec path.

Recommended defensive actions

  • Apply the upstream stable kernel fix referenced in the supplied Linux kernel commit links.
  • Check whether any shipped kernel builds include the rt1011 ASoC codec path and backport the fix where needed.
  • Validate updated kernels on affected devices to confirm audio functionality and system stability.
  • Track distro or vendor advisories for backport status if you cannot move immediately to a fixed kernel release.

Evidence notes

The supplied NVD record identifies CVE-2026-43478 with vulnStatus 'Received' and no CVSS data in the corpus. The description explicitly states the fix: use snd_soc_component_to_dapm() in rt1011_recv_spk_mode_put() because kcontrol can return NULL. Two official Linux kernel stable commit URLs are provided as source references, supporting that this is a kernel patch-level issue.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43478 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43478

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43478 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43478

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/30e4b2290cc2a8d1b9ddb9dcb9c981df1f2a7399

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b10b2b15b45923ff2807eeb034d91a39b0a3e690

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.