CVE-2026-80872
Received Received - Intake

Use-after-Free in Linux Kernel ALSA HDA TAS2781 Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with request_firmware_nowait(). The firmware loader keeps the callback module pinned and holds a device reference, but the callback still uses driver-private HDA state. Component unbind removes controls and DSP state immediately. Later device removal tears down the TAS2781 private data, including codec_lock. If the async firmware callback runs after unbind has started, it can operate on state that is being torn down. Cancel or synchronize the async firmware request before removing controls and DSP state. A queued callback is cancelled, and an already-running callback is allowed to finish before unbind continues.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80872
EUVD
EUVD-2026-71502

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the TAS2781 HDA audio driver. When the driver is unbound from a device, it fails to properly cancel an asynchronous firmware loading request. This can lead to the firmware callback attempting to access driver-private state that is being torn down, potentially causing system instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA HDA TAS2781 driver. Detection requires checking kernel logs for firmware loading errors or crashes related to the TAS2781 component. Use commands like dmesg | grep tas2781 or journalctl -k | grep tas2781 to inspect kernel logs for errors.

Impact Analysis

If exploited, this vulnerability could cause kernel crashes, system freezes, or denial-of-service conditions on affected systems. Users might experience audio device malfunctions or unexpected system reboots. Systems with TAS2781 audio hardware are primarily at risk.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. Monitor kernel updates from your distribution and apply them promptly. If immediate patching is not possible, avoid unbinding the TAS2781 component while the system is running to prevent potential crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80872. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart