CVE-2026-64481: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64481 Overview

CVE-2026-64481 is a use-after-free vulnerability in the Linux kernel's ALSA hda/cs35l41 driver. The cs35l41_hda component creates ALSA controls whose private data references the cs35l41_hda object, and the firmware load control can queue fw_load_work. Because these controls are not removed on component unbind, and cs35l41_remove_dsp() is skipped when halo_initialized is false, a worker can execute after driver teardown and dereference invalid driver state. The flaw was fixed by tracking created controls, removing them on unbind, and canceling fw_load_work unconditionally during device removal before runtime PM teardown.

Critical Impact
A local attacker with the ability to trigger firmware load requests and driver unbind can cause kernel memory corruption, leading to denial of service or potential local privilege escalation.

Affected Products

Linux kernel versions containing the cs35l41_hda ALSA driver prior to the fix
Systems using Cirrus Logic CS35L41 audio amplifier hardware
Distributions shipping vulnerable kernel builds with firmware_autostart behavior exposed

Discovery Timeline

2026-07-25 - CVE-2026-64481 published to the National Vulnerability Database
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64481

Vulnerability Analysis

The cs35l41_hda driver exposes ALSA controls whose private data pointer references the cs35l41_hda driver object. One of these controls triggers firmware loading, which the driver dispatches asynchronously through the fw_load_work workqueue item. The controls persist beyond the driver's component unbind path because the driver never explicitly removes them during teardown.

Device removal calls cs35l41_remove_dsp() to cancel fw_load_work, but only when halo_initialized is true. With firmware_autostart disabled, a firmware load request can occur before the DSP is initialized. If component unbind or device removal then proceeds, the queued worker runs against freed driver state, producing a classic use-after-free condition on kernel memory.

Root Cause

The root cause is missing lifecycle management between ALSA control callbacks, queued work items, and driver teardown. The driver did not track its created controls for removal, and the cancellation of fw_load_work was conditional on DSP initialization state rather than executed unconditionally. This left a window where control callbacks or work items could reference cs35l41_hda structures after they were released.

Attack Vector

Exploitation requires local access with permissions to interact with ALSA control interfaces on affected systems. An attacker with access to the sound subsystem can queue firmware load work before DSP initialization completes, then trigger a device unbind or removal event to race the worker against teardown. The vulnerability is not remotely exploitable and requires no user interaction beyond the attacker's own actions.

Code-level details are available in the upstream fixes:

Detection Methods for CVE-2026-64481

Indicators of Compromise

Unexpected kernel oops or panic messages referencing cs35l41_hda, fw_load_work, or ALSA control callbacks in dmesg or journalctl -k output
KASAN use-after-free reports involving cs35l41 symbols when kernel address sanitizer is enabled
Audio subsystem instability or repeated driver rebind cycles on systems with Cirrus Logic CS35L41 amplifiers

Detection Strategies

Inventory running kernel versions across the fleet and compare against distribution advisories referencing the four upstream commits listed above
Enable kernel lockdown, KASAN, or KFENCE in test environments to surface use-after-free conditions in the ALSA path
Monitor for anomalous driver bind or unbind events tied to sound hardware, particularly on laptops shipping the CS35L41

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on strings such as BUG: KASAN, general protection fault, or driver names tied to cs35l41
Track kernel package versions through configuration management and flag hosts running vulnerable builds after the patch is released
Correlate unexpected audio driver crashes with local process activity to identify potential exploitation attempts

How to Mitigate CVE-2026-64481

Immediate Actions Required

Apply the upstream Linux kernel patches from the four referenced commits or install the vendor-provided kernel update once available for your distribution
Restrict local user access to systems that cannot be immediately patched, particularly multi-user hosts with the CS35L41 driver loaded
Audit which endpoints load the snd_hda_scodec_cs35l41 module and prioritize patching those hosts

Patch Information

The fix tracks created ALSA controls and removes them on component unbind so no control callback can reach driver data or queue further work. It then cancels fw_load_work to drain queued requests and cancels the work unconditionally during device remove before runtime PM teardown. Patches are available in the stable trees via commits 8947215, b65020d, ce0a903, and d6a40a4 on git.kernel.org.

Workarounds

Blacklist the snd_hda_scodec_cs35l41 module on systems that do not require CS35L41 audio functionality until the patched kernel is deployed
Avoid toggling firmware_autostart or repeatedly binding and unbinding the driver on unpatched systems
Limit shell access on affected hosts to trusted administrators to reduce the local attack surface

bash

# Blacklist the vulnerable module until a patched kernel is installed
echo "blacklist snd_hda_scodec_cs35l41" | sudo tee /etc/modprobe.d/blacklist-cs35l41.conf
sudo update-initramfs -u
# Reboot for changes to take effect
sudo reboot