Linux Kernel Use-After-Free Vulnerability in ASoC sof_es8336 Driver

A use-after-free vulnerability has been identified in the Linux kernel's ASoC sof_es8336 driver. The issue arises in the sof_es8336_remove() function, which calls cancel_delayed_work() to cancel a scheduled work item. However, this function does not wait for the work item to complete, potentially allowing the callback to execute after the driver has been removed, leading to a use-after-free condition. This vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability could lead to a use-after-free condition, potentially allowing for memory corruption or arbitrary code execution.

Remediation

The vulnerability has been addressed by modifying the sof_es8336_remove() function to use cancel_delayed_work_sync(), which properly cancels the work item, ensuring it is not running and cannot re-schedule itself. Users should upgrade to the patched version of the Linux kernel.