Cloudanix VulnDB

CVE-2026-80872

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in Linux audio driver code can let the system access memory that has already been cleaned up, risking crashes on certain sound hardware.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in ALSA hda/tas2781 driver where an asynchronous firmware load callback (via request_firmware_nowait) can execute after component unbind has torn down HDA controls, DSP state, and codec_lock.

Why it matters to the business

Potential kernel instability or crashes on systems using TAS2781 audio codecs during driver unload or device reconfiguration, increasing downtime for audio hardware.

How an attack unfolds

An attacker triggers repeated bind/unbind cycles of the TAS2781 component (for example via module reload or power management events) to race the async firmware callback against state teardown, resulting in memory corruption after the private data and locks are freed.

How to fix it

Apply the upstream kernel patch that cancels or synchronizes the async firmware request before unbind proceeds; rebuild and deploy the fixed kernel image to all affected systems.

How to confirm the fix worked

Confirm the presence of the cancel/sync logic in the tas2781 component unbind path in the running kernel source or binary; test by exercising bind/unbind sequences and verifying no use-after-free warnings in the kernel log.

Typical attack path

  1. Load or bind the TAS2781 HDA component to queue an async firmware request
  2. Initiate component unbind to immediately remove controls and DSP state
  3. Allow or force the queued firmware callback to run after unbind teardown begins
  4. Access freed codec_lock or driver-private structures inside the callback

How to detect it

Review kernel logs for use-after-free or slab corruption warnings referencing tas2781, hda, or codec_lock during module unbind or device removal events; correlate with firmware request activity in dmesg.

What your security team should do

  • Prioritize kernel updates containing the tas2781 async firmware cancel fix on all systems with TAS2781 hardware
  • Monitor for kernel oops or slab-use-after-free reports involving tas2781 or hda_codec during driver unload
  • Restrict unprivileged module loading and device reconfiguration where feasible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with request_firmware_nowait(). The firmware loader keeps the callback module pinned and holds a device reference, but the callback still uses driver-private HDA state. Component unbind removes controls and DSP state immediately. Later device removal tears down the TAS2781 private data, including codec_lock. If the async firmware callback runs after unbind has started, it can operate on state that is being torn down. Cancel or synchronize the async firmware request before removing controls and DSP state. A queued callback is cancelled, and an already-running callback is allowed to finish before unbind continues.

Affected packages

Ecosystem Package Introduced Fixed