CVE-2026-45963

What it actually does

This is a local denial-of-service flaw in the Linux kernel ASoC NAU8821 audio codec driver. The driver can leave delayed jack-detection work queued while the component is being removed or unloaded. When that delayed work later runs, it may reference driver/component state that has already been torn down, causing a kernel page fault or oops in the workqueue path and potentially crashing the system. The known impact is loss of availability; there is no indication from the provided data that this enables confidentiality compromise, data modification, or reliable privilege escalation.

Why it matters to the business

Systems using the affected Linux kernel driver can be crashed by a local attacker or by an operational sequence that unloads/removes the audio component while jack-detection work is pending. The practical consequence is unexpected reboot, service interruption, loss of unsaved work, degraded device availability, and potential downtime for endpoints or embedded systems that include the NAU8821 audio codec. EPSS is currently very low and it is not listed in CISA KEV, so broad active exploitation is not indicated, but affected fleets should still remediate through normal kernel maintenance because kernel crashes can disrupt operations.

How an attack unfolds

An attacker needs local access and a way to influence the affected driver lifecycle. They first identify a system using the snd_soc_nau8821 driver, then cause or wait for NAU8821 jack-detection work to be scheduled. Before that delayed work executes, they trigger removal of the component or unload/unbind the driver. Because vulnerable kernels do not cancel or flush the pending delayed work during component removal, the queued work later executes against removed state. When the workqueue invokes nau8821_jdet_work and reaches audio power-management operations such as snd_soc_dapm_disable_pin, the kernel may dereference invalid memory and fault, leading to an oops, panic, or system crash. Exploitation is local and availability-focused; there is no evidence of remote exploitation or ransomware use in the supplied intelligence.

How to fix it

Apply a Linux kernel update that includes the upstream fix for the NAU8821 ASoC driver to cancel or flush delayed jack-detection work during component removal. No exact fixed package versions were provided, so use the fixed kernel releases from the relevant Linux distribution, device vendor, or kernel stable branch once available. If immediate patching is not possible, reduce exposure by preventing untrusted local users from loading, unloading, or unbinding kernel modules and device drivers; restrict sudo/polkit rules that permit modprobe, rmmod, sysfs driver unbind, or power-management operations; and disable or blacklist snd_soc_nau8821 only where the hardware and audio functionality are not required. Mitigations should be treated as temporary because the correct fix is to run a kernel containing the delayed-work cancellation change.

How to confirm the fix worked

Confirm the running kernel package includes the vendor or upstream patch for the ASoC NAU8821 component removal path. Validate exposure by checking whether the system has the NAU8821 driver loaded or available, for example with lsmod, modinfo, kernel configuration, or distribution package metadata. On patched systems, driver removal or unbind testing in a controlled maintenance environment should not produce kernel oops messages referencing nau8821_jdet_work, snd_soc_nau8821, or snd_soc_dapm_disable_pin. Also verify that local privilege controls prevent non-administrative users from unloading modules, writing to sysfs driver unbind paths, or invoking privileged power/device-management operations.

Typical attack path

1. Obtain local access to a Linux system running an affected kernel with the NAU8821 ASoC codec driver present or loaded.
2. Confirm the snd_soc_nau8821 module or built-in driver is active and associated with hardware or a component instance.
3. Trigger or wait for a jack-detection event that schedules the driver's delayed jdet_work task.
4. Before the delayed work executes, trigger component removal, module unload, device unbind, or another driver teardown path.
5. Allow the queued workqueue task to run after component removal.
6. The stale work item accesses removed driver state, causing a kernel page fault/oops and denial of service.

How to detect it

Look for evidence of prior kernel crashes or oops events involving the NAU8821 audio driver. Primary log sources include journald, dmesg, /var/log/kern.log, /var/log/messages, /var/log/syslog, persistent pstore logs, kernel crash dumps, kdump/vmcore artifacts, auditd logs, sudo logs, shell history where available, and EDR telemetry for module-management commands. Search for kernel traces that include 'Workqueue: events nau8821_jdet_work [snd_soc_nau8821]', 'BUG: unable to handle page fault', 'snd_soc_dapm_disable_pin', and 'nau8821_jdet_work'. Correlate those events with recent execution of rmmod, modprobe -r, insmod, modprobe, driver unbind writes under /sys/bus/*/drivers/*/unbind, suspend/resume events, audio jack events, or unexpected module removal. Because the flaw causes denial of service rather than leaving a durable payload, absence of file-based artifacts does not rule out attempted exploitation; kernel logs and crash dumps are the most useful evidence.

• Workqueue: events nau8821_jdet_work [snd_soc_nau8821]
• nau8821_jdet_work
• snd_soc_nau8821
• snd_soc_dapm_disable_pin
• BUG: unable to handle page fault
• RIP: 0010:__mutex_lock
• process_one_work
• worker_thread
• rmmod snd_soc_nau8821
• modprobe -r snd_soc_nau8821
• /sys/bus/*/drivers/*/unbind
• kernel: BUG: unable to handle page fault
• kernel: Workqueue: events nau8821_jdet_work

What your security team should do

• Inventory Linux systems for the snd_soc_nau8821 driver, especially endpoints, handhelds, embedded devices, and audio-enabled hardware using the NAU8821 codec.
• Prioritize kernel updates for systems where the driver is present and where local users or applications can influence device removal, module unloading, suspend/resume, or audio jack events.
• Monitor vendor advisories and distribution kernel changelogs for the NAU8821 delayed-work cancellation fix, since exact fixed package versions were not supplied.
• Restrict local administrative pathways that allow module unload, driver unbind, or direct writes to sensitive sysfs device-management interfaces.
• Add SIEM detections for kernel oops or panic logs containing nau8821_jdet_work or snd_soc_nau8821, and correlate with recent rmmod, modprobe, unbind, suspend/resume, or audio device events.
• If repeated crashes are observed on affected hardware, preserve kernel logs, crash dumps, module state, and recent privilege-escalation/audit logs before reimaging or reboot cycling.
• Treat confirmed exploitation as a local availability incident; investigate the local account, process, or automation that triggered driver teardown rather than assuming remote compromise.