CVE-2026-80872: Linux Kernel ALSA Use-After-Free Vulnerability

CVE-2026-80872 Overview

CVE-2026-80872 is a Linux kernel vulnerability in the ALSA hda/tas2781 driver for Texas Instruments TAS2781 smart amplifiers. The TAS2781 HDA I2C and SPI code queues RCA firmware loading during component bind using request_firmware_nowait(). If the asynchronous firmware callback fires after component unbind has started, it operates on driver-private HDA state that is being torn down, including codec_lock.

The upstream fix cancels or synchronizes the pending async firmware request before removing controls and DSP state during unbind.

Critical Impact
A queued firmware callback executing after unbind can dereference freed driver state, leading to kernel memory corruption or a denial-of-service crash on affected audio hardware.

Affected Products

Linux kernel sound/pci/hda/tas2781_hda_i2c.c component
Linux kernel sound/pci/hda/tas2781_hda_spi.c component
Systems using Texas Instruments TAS2781 smart amplifiers via HDA

Discovery Timeline

2026-09-04 - CVE-2026-80872 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80872

Vulnerability Analysis

The defect is a Use-After-Free race condition in the TAS2781 HDA driver's lifecycle. On component bind, the driver calls request_firmware_nowait() to load the RCA firmware asynchronously. The firmware loader pins the callback module and holds a reference to the underlying device, but the callback function still touches driver-private HDA state managed by the parent codec.

Component unbind removes ALSA controls and DSP state immediately. Later device removal frees the TAS2781 private data structure, including the embedded codec_lock mutex. Between these two events, a pending or in-flight async callback can acquire codec_lock or read fields that no longer exist, corrupting kernel memory or triggering a kernel oops.

Root Cause

The driver did not synchronize the asynchronous firmware request with its component unbind path. Module and device references held by the firmware loader are insufficient because the callback depends on driver-private state that is torn down earlier in the unbind sequence. The mismatch between lifetime of the firmware callback and lifetime of the codec state produces the race.

Attack Vector

The vulnerability is triggered by device lifecycle events rather than remote input. A local actor with the ability to bind and unbind the audio component, trigger suspend/resume, or force module unload during firmware loading can race the async callback against teardown. Physical or administrative access is required, and the practical outcome is a kernel crash on affected TAS2781-equipped hardware.

No verified public exploit or proof-of-concept is available. See the upstream commits for the exact code paths involved: Kernel Git Commit 5367e2a, Kernel Git Commit da9e3be, and Kernel Git Commit f827233.

Detection Methods for CVE-2026-80872

Indicators of Compromise

Kernel oops or panic messages referencing tas2781_hda_i2c or tas2781_hda_spi during module unload, suspend, or resume.
KASAN reports of use-after-free involving codec_lock or TAS2781 driver-private structures.
Audio subsystem failures shortly after firmware load events logged by the firmware_class subsystem.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) and lockdep on test kernels to surface the race deterministically during driver bind/unbind cycles.
Correlate dmesg entries showing TAS2781 firmware requests with subsequent component unbind or module removal events.
Inventory hosts running affected kernel versions with TAS2781 hardware present to prioritize patching.

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on kernel oops signatures naming tas2781 symbols.
Track kernel package versions across the fleet and flag systems still running vulnerable builds.
Monitor unexpected reboots or audio subsystem restarts on laptops and workstations equipped with TI smart amplifiers.

How to Mitigate CVE-2026-80872

Immediate Actions Required

Apply the stable-tree patches referenced in the upstream commits to any kernel that ships the TAS2781 HDA driver.
Update to a distribution kernel that includes the fix once vendors publish backports.
Avoid scripted or automated unbind, module reload, and suspend cycles on affected hardware until patched.

Patch Information

The fix cancels or synchronizes the pending request_firmware_nowait() callback before controls and DSP state are removed during component unbind. A queued callback is cancelled outright, and an already-running callback is allowed to finish before unbind continues. The change is applied in commits 5367e2a, da9e3be, and f827233.

Workarounds

Blacklist the snd_hda_scodec_tas2781_i2c or snd_hda_scodec_tas2781_spi modules on non-critical systems where audio output is not required.
Avoid unloading the TAS2781 modules while the system is active; keep them loaded across the session to prevent the unbind race.
Disable driver auto-probe for the affected component until the patched kernel is deployed.

bash

# Verify running kernel and check for the TAS2781 module
uname -r
lsmod | grep tas2781

# Optional: prevent module load pending patch deployment
echo "blacklist snd_hda_scodec_tas2781_i2c" | sudo tee /etc/modprobe.d/tas2781.conf
echo "blacklist snd_hda_scodec_tas2781_spi" | sudo tee -a /etc/modprobe.d/tas2781.conf
sudo update-initramfs -u