CVE-2026-53348

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SDCA: fix NULL pointer dereference in sdcadevunregister_functions

sdcadevunregisterfunctions() iterates over all SDCA function descriptors and calls sdcadevunregister() on each funcdev without checking for NULL. When a function registration has failed partway through, or the device cleanup races with probe deferral, func_dev entries may be NULL, leading to a kernel oops:

BUG: kernel NULL pointer dereference, address: 0000000000000040 RIP: 0010:devicedel+0x1e/0x3e0 Call Trace: sdcadevunregisterfunctions+0x37/0x60 [sndsocsdca] releasenodes+0x35/0xb0 devresreleaseall+0x90/0x100 deviceunbindcleanup+0xe/0x80 devicereleasedriverinternal+0x1c1/0x200 busremovedevice+0xc6/0x130 devicedel+0x161/0x3e0 deviceunregister+0x17/0x60 sdwdeleteslave+0xb6/0xd0 [soundwirebus] sdwbusmasterdelete+0x1e/0x50 [soundwirebus] ... sofprobework+0x19/0x30 [sndsof]

This was observed on a Lenovo ThinkPad X1 Carbon G14 (Panther Lake) with the SOF audio driver probe failing due to missing Panther Lake firmware, causing the subsequent cleanup of SoundWire devices to trigger the crash.

Fix this with three changes:

1) Add a NULL guard in sdcadevunregister() so that callers do not need to pre-validate the pointer (defense in depth).

2) In sdcadevunregisterfunctions(), skip NULL funcdev entries and clear func_dev to NULL after unregistration, making the function idempotent and safe against double-invocation.

3) In sdcadevregister_functions(), roll back all previously registered functions when a later one fails, so the function array is never left in a partially-populated state.