From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DD1B039656C for ; Sat, 25 Jul 2026 09:02:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784970176; cv=none; b=odV6IDGpgR8wWh+ijnxbzSXApKGIGyXm2j3efHv2Dc+pjahc6BKNyroPe0qcged1ZFrMqQ8QaLKek1+HurAn28RGtK1pLDVYCWwZ+3YC91TIuOu8BpvDywrXOiKsCg8NtMLpuzFX5G1UIRrf0dIabT60IeDd2QLu5zeuPAjRgXM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784970176; c=relaxed/simple; bh=CwIIxuKSNKG5IWQQHRjuaLDoa1c9YQyI4WGaBCLrSHs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=XtBeyHNVlrRgjT9T3o8Rus7TOrpzTjssJlmH0A95wXKCnvMBUjyYaZkGHQ2tdEYH6K55HX9nHqYI7jn4tj6QcgjVxsP9KNpH8cAYq+DyClPKcZhv88uwVeoE0jLkCBtXha4fTPAffDuMIZA8oaCT7Wh6AiJ1T1T3GFhTJdbo/3Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=fhltgcLt; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="fhltgcLt" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34FF21F000E9; Sat, 25 Jul 2026 09:02:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784970174; bh=wqXh0jxQ48hpj9jtb974DxuVhpePGIKXwEjWNyAvTUM=; h=From:To:Cc:Subject:Date:Reply-To; b=fhltgcLtt+29jx2ePjq+Evusf7XGg1qlRa3V02q6HliUHZGMu9u6PREh1EohnqdTr rp2oXnbfOoy7TlcsyywwDEQ+8PmPH5/4CsGuTxvsgR1jVy1FG2f8hDfmCBGsfLilCu UFqGskYyRvQF+3971MvekB3YhUnSnB6q5dR5yQm4= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown Date: Sat, 25 Jul 2026 10:51:38 +0200 Message-ID: <2026072548-CVE-2026-64481-d8df@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3158; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=4G2598lIvJT/+5YSKFBBS2CujnlpasQZsXSuptIHxYQ=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkpFQVtJUt3M9jGhzDO1zut7eJuIHhs0q7pSy9aXLJau +NiW+WujlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZjI3/UM88sOZ79J5l1+zv3S M96LMtF53WInGxjmu3Xci/lfbJ80P1WuWLpY4lLQryw3AA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41_hda creates ALSA controls whose private data points at the cs35l41_hda object. The firmware load control can also queue fw_load_work. Those controls are not removed on component unbind, and device remove only cancels fw_load_work through cs35l41_remove_dsp(). That helper is skipped when halo_initialized is false. With firmware_autostart disabled, a firmware load can be requested before the DSP has been initialized. If the component or device is removed before the queued work runs, the worker can run after teardown and dereference driver state that is no longer valid. Track the created controls and remove them on unbind so no new control callback can reach the driver data or queue more work. Then cancel fw_load_work to drain any request that was already queued. Also cancel the work unconditionally during device remove before runtime PM teardown. The Linux kernel CVE team has assigned CVE-2026-64481 to this issue. Affected and fixed versions =========================== Issue introduced in 6.0 with commit 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 and fixed in 6.12.97 with commit 8947215c0136c9d905e4a46d824824f8b48a2e5b Issue introduced in 6.0 with commit 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 and fixed in 6.18.39 with commit ce0a903d0591e3e2c790c5b628802b08d1b287cc Issue introduced in 6.0 with commit 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 and fixed in 7.1.4 with commit d6a40a4d083ef74d00c8f9516cb5ff07ac70720b Issue introduced in 6.0 with commit 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 and fixed in 7.2-rc1 with commit b65020d5398f499c09498c9786dba6d67ae57664 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64481 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: sound/hda/codecs/side-codecs/cs35l41_hda.c sound/hda/codecs/side-codecs/cs35l41_hda.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/8947215c0136c9d905e4a46d824824f8b48a2e5b https://git.kernel.org/stable/c/ce0a903d0591e3e2c790c5b628802b08d1b287cc https://git.kernel.org/stable/c/d6a40a4d083ef74d00c8f9516cb5ff07ac70720b https://git.kernel.org/stable/c/b65020d5398f499c09498c9786dba6d67ae57664