CVE-2026-80872 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/tas2781: Cancel async firmware request at unbind
TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with request_firmware_nowait(). The firmware loader keeps the callback module pinned and holds a device reference, but the callback still uses driver-private HDA state.
Component unbind removes controls and DSP state immediately. Later device removal tears down the TAS2781 private data, including codec_lock. If the async firmware callback runs after unbind has started, it can operate on state that is being torn down.
Cancel or synchronize the async firmware request before removing controls and DSP state. A queued callback is cancelled, and an already-running callback is allowed to finish before unbind continues.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in the Linux kernel's ALSA HDA TAS2781 driver represents a classic race condition arising from asynchronous operations interacting with resource lifecycle management. The TAS2781 audio codec, accessible via I2C and SPI interfaces within an HD Audio context, initiates firmware loading through the request_firmware_nowait function during component binding. This mechanism is designed to load firmware asynchronously without blocking the driver initialization process. However, this asynchronous approach introduces a critical timing dependency where the firmware loader maintains a reference count on the callback module and holds a device reference while the actual loading operation proceeds in the background. The core issue lies in the disconnect between the asynchronous nature of the firmware request and the synchronous teardown sequence performed during component unbind or device removal operations.
During normal driver operation, the TAS2781 private data structure contains essential state information including codec locks and DSP configuration states that are required for both runtime audio processing and firmware loading callbacks. When a user space application closes an ALSA control interface or when the system initiates a hot-unplug event, the component unbind routine is triggered. This routine immediately proceeds to remove controls and clear DSP state without waiting for any pending asynchronous operations associated with the device. Subsequently, during device removal, the private data structure including the codec_lock mutex is freed. If the async firmware callback initiated earlier has not yet completed its execution by this point, it may attempt to access or modify these now-freed resources. This creates a use-after-free scenario where kernel memory that has been returned to the allocator pool is accessed by an active thread of execution within the firmware loading context.
The operational impact of this vulnerability can range from subtle data corruption to severe system instability. In less severe cases, accessing freed memory might result in incorrect audio processing or failure to load new firmware after a rebind event due to corrupted state variables. However, more critically, if the callback accesses kernel structures that have been reallocated for other purposes, it can lead to arbitrary code execution with kernel privileges. This aligns with CWE-416 which describes Use After Free vulnerabilities where references are made to freed memory leading to unpredictable behavior and potential security breaches. The lack of synchronization between the unbind process and the asynchronous firmware callback allows an attacker who can trigger device removal or control interface closure to potentially exploit this race condition, especially in environments where physical access or local user privileges allow for rapid binding and unbinding cycles.
From a threat modeling perspective using MITRE ATT&CK frameworks, this vulnerability facilitates techniques related to privilege escalation through exploitation of kernel memory corruption vulnerabilities such as CWE-416. An attacker could leverage the timing window between component unbind initiation and private data teardown to inject malicious payloads or escalate privileges by corrupting critical kernel structures like spinlocks or mutexes that are accessed during the firmware callback execution. The vulnerability is particularly dangerous because it does not require complex exploitation techniques beyond triggering specific driver state transitions, making it a viable target for local privilege escalation attacks against systems running affected Linux kernels with TAS2781 audio hardware enabled.
The resolution implemented in this patch addresses the root cause by enforcing strict synchronization between the asynchronous firmware loading process and the device lifecycle management routines. Specifically, the fix ensures that before removing controls and DSP state during unbind, any queued async firmware requests are explicitly cancelled using appropriate cancellation APIs provided by the kernel firmware loader subsystem. For callbacks that have already started executing but not yet completed, the driver now waits for their completion before proceeding with resource teardown. This guarantees that no active callback holds references to private data structures that are being freed or modified concurrently. By implementing this synchronization barrier, the race condition is eliminated ensuring that all asynchronous operations complete safely before any associated resources are released.
To mitigate similar issues in other drivers and systems, it is essential to adhere to strict resource management protocols where asynchronous tasks must be explicitly synchronized with their parent device lifecycle events. Developers should always check for pending async work during unbind routines and utilize kernel primitives like wait_for_completion or cancel_work_sync equivalents depending on the specific API used. Additionally implementing reference counting mechanisms that prevent module unload while active callbacks are in progress can provide an additional layer of protection against use-after-free conditions. Regular static analysis tools focused on concurrency bugs and race condition detection should be integrated into development workflows to identify such timing dependencies before they reach production kernels. Maintaining clear separation between initialization, runtime operation, and teardown phases ensures that asynchronous operations do not outlive the resources they depend upon preventing memory corruption vulnerabilities in complex kernel subsystems like ALSA audio drivers.