---
id: CVE-2026-64481
title: 'ALSA: hda/cs35l41: Fix firmware load work teardown'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: hda/cs35l41: Fix firmware load work teardown

  cs35l41_hda creates ALSA controls whose private data points at the
  cs35l41_hda object. The firmware load control can…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 <
    8947215c0136c9d905e4a46d824824f8b48a2e5b
  - >-
    Linux >= 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 <
    ce0a903d0591e3e2c790c5b628802b08d1b287cc
  - >-
    Linux >= 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 <
    d6a40a4d083ef74d00c8f9516cb5ff07ac70720b
  - >-
    Linux >= 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 <
    b65020d5398f499c09498c9786dba6d67ae57664
  - Linux 6.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:41:19.470343Z'
published: '2026-07-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:38.134Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64481'
references:
  - url: 'https://git.kernel.org/stable/c/8947215c0136c9d905e4a46d824824f8b48a2e5b'
  - url: 'https://git.kernel.org/stable/c/ce0a903d0591e3e2c790c5b628802b08d1b287cc'
  - url: 'https://git.kernel.org/stable/c/d6a40a4d083ef74d00c8f9516cb5ff07ac70720b'
  - url: 'https://git.kernel.org/stable/c/b65020d5398f499c09498c9786dba6d67ae57664'
tags:
  - cve.org
epss: 0.00138
epssPercentile: 0.02885
ingestedAt: '2026-10-16T17:24:46.823Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda/cs35l41: Fix firmware load work teardown

cs35l41_hda creates ALSA controls whose private data points at the
cs35l41_hda object. The firmware load control can also queue
fw_load_work.

Those controls are not removed on component unbind, and device remove
only cancels fw_load_work through cs35l41_remove_dsp(). That helper is
skipped when halo_initialized is false. With firmware_autostart
disabled, a firmware load can be requested before the DSP has been
initialized. If the component or device is removed before the queued
work runs, the worker can run after teardown and dereference driver
state that is no longer valid.

Track the created controls and remove them on unbind so no new control
callback can reach the driver data or queue more work. Then cancel
fw_load_work to drain any request that was already queued. Also cancel
the work unconditionally during device remove before runtime PM teardown.

## Affected

- `Linux >= 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 < 8947215c0136c9d905e4a46d824824f8b48a2e5b`
- `Linux >= 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 < ce0a903d0591e3e2c790c5b628802b08d1b287cc`
- `Linux >= 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 < d6a40a4d083ef74d00c8f9516cb5ff07ac70720b`
- `Linux >= 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 < b65020d5398f499c09498c9786dba6d67ae57664`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.