Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with request_firmware_nowait(). The firmware loader keeps the callback module pinned and holds a device reference, but the callback still uses driver-private HDA state. Component unbind removes controls and DSP state immediately. Later device removal tears down the TAS2781 private data, including codec_lock. If the async firmware callback runs after unbind has started, it can operate on state that is being torn down. Cancel or synchronize the async firmware request before removing controls and DSP state. A queued callback is cancelled, and an already-running callback is allowed to finish before unbind continues.
References
- https://git.kernel.org/stable/c/5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9
- https://git.kernel.org/stable/c/da9e3be9cf31d7138d23e9e2f7ba1c102ef09f07
- https://git.kernel.org/stable/c/f8272331da877eec8fe8e89a1e98e6a710e12490
FAQ
What is CVE-2026-80872?
CVE-2026-80872 is a documented vulnerability. In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind ...
How severe is CVE-2026-80872?
CVSS scoring is not yet available for CVE-2026-80872. Check NVD for updates.
Is there a patch for CVE-2026-80872?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.