CVE-2026-64481

A flaw was found in the Linux kernel's ALSA sound driver for the cs35l41 component. This vulnerability occurs because the driver fails to properly remove controls and cancel firmware load work during component unbinding or device removal, especially when firmware autostart is disabled. This can lead to a worker attempting to access driver data that is no longer valid after teardown, resulting in memory corruption. An attacker with local access could potentially exploit this to cause a denial of service or escalate privileges.

ALSA HDA cs35l41 firmware load handling can leave ALSA controls and fw_load_work alive across component unbind or device remove. The controls store cs35l41_hda as private data and the firmware load control can queue work before the DSP is initialized when firmware_autostart is disabled. If teardown happens before the queued work runs, the worker or a later control callback can dereference driver state that is no longer valid, creating a race based use-after-free candidate and a likely kernel crash. For the CVSS the PR:L is used because a local user with access to ALSA controls may request firmware loading, while the teardown timing is treated as high complexity rather than as an additional privilege requirement. The issue is not network reachable. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel use-after-free, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.