Skip to content
Fencer Vulns
high 7.8

CVE-2026-64481 json

ALSA: hda/cs35l41: Fix firmware load work teardown

published 2026-07-25 3 mo ago modified 2026-11-03 5 d ago also EUVD-2026-48825

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda/cs35l41: Fix firmware load work teardown

cs35l41_hda creates ALSA controls whose private data points at the cs35l41_hda object. The firmware load control can also queue fw_load_work.

Those controls are not removed on component unbind, and device remove only cancels fw_load_work through cs35l41_remove_dsp(). That helper is skipped when halo_initialized is false. With firmware_autostart disabled, a firmware load can be requested before the DSP has been initialized. If the component or device is removed before the queued work runs, the worker can run after teardown and dereference driver state that is no longer valid.

Track the created controls and remove them on unbind so no new control callback can reach the driver data or queue more work. Then cancel fw_load_work to drain any request that was already queued. Also cancel the work unconditionally during device remove before runtime PM teardown.

Patch / fix

  • Linux Linux 6.1.191, 6.6.160, 6.12.97, 6.18.39, 7.1.4, 7.2
  • linux Debian 13 6.12.100-1
  • linux Debian 14 7.1.4-1
  • linux-6.12 Debian 12 6.12.100-1~deb12u1

debian advisories DEBIAN-CVE-2026-64481

  • linux Ubuntu 24.04 LTS 6.8.0-147.147
  • linux Ubuntu 26.04 LTS 7.0.0-31.31
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1067.70
  • linux-aws Ubuntu 26.04 LTS 7.0.0-1012.12
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1071.79
  • linux-gcp Ubuntu 26.04 LTS 7.0.0-1011.11
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1066.74
  • linux-gke Ubuntu 26.04 LTS 7.0.0-1006.7

ubuntu advisories UBUNTU-CVE-2026-64481

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-64kb SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS, SLE High Performance Computing 15 SP5-ESPOS 5.14.21-150500.55.189.1
  • kernel-syms SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.189.1
  • kernel-source SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.189.1
  • kernel-default SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 5.14.21-150500.55.189.1
  • kernel-obs-build SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.189.1
  • kernel-default-base SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.189.1.150500.6.87.4
  • kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.81.1
  • kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.81.1

suse advisories SUSE-SU-2026:4595-1SUSE-SU-2026:4254-1SUSE-SU-2026:4369-1SUSE-SU-2026:4347-1SUSE-SU-2026:4284-1SUSE-SU-2026:23887-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.38.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.38.1

opensuse advisories openSUSE-SU-2026:21910-1openSUSE-SU-2026:11476-1

  • kernel AlmaLinux 9 5.14.0-687.60.1.el9_8
  • rv AlmaLinux 9 5.14.0-687.60.1.el9_8
  • perf AlmaLinux 9 5.14.0-687.60.1.el9_8
  • rtla AlmaLinux 9 5.14.0-687.60.1.el9_8
  • libperf AlmaLinux 9 5.14.0-687.60.1.el9_8
  • kernel-rt AlmaLinux 9 5.14.0-687.60.1.el9_8
  • kernel-64k AlmaLinux 9 5.14.0-687.60.1.el9_8
  • kernel-core AlmaLinux 9 5.14.0-687.60.1.el9_8

almalinux advisories ALSA-2026:87805ALSA-2026:88477

  • kernel Rocky Linux 10 6.12.0-211.68.1.el10_2
  • kernel Rocky Linux 9 5.14.0-687.60.1.el9_8

rocky linux advisories RLSA-2026:88477RLSA-2026:87805

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-64481 updated cvss 4.7

kernel: ALSA: hda/cs35l41: Fix firmware load work teardown

  • Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
    affected: workaround, no fix available
  • Red Hat Enterprise Linux kernel-modules-internal 6.12.0-211.68.1.el10_2
    fixed: vendor fix RHSA-2026:88477
  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-687.60.1.el9_8, perf 5.14.0-687.60.1.el9_8, rtla 5.14.0-687.60.1.el9_8, python3-perf 5.14.0-687.60.1.el9_8, kernel-devel-matched 5.14.0-687.60.1.el9_8, kernel-64k-devel-matched 5.14.0-687.60.1.el9_8, +7 more
    fixed: vendor fix RHSA-2026:87805
  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.68.1.el10_2, perf 6.12.0-211.68.1.el10_2, rtla 6.12.0-211.68.1.el10_2, python3-perf 6.12.0-211.68.1.el10_2, kernel-devel-matched 6.12.0-211.68.1.el10_2, kernel-64k-devel-matched 6.12.0-211.68.1.el10_2, +7 more
    fixed: vendor fix RHSA-2026:88477
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-687.60.1.el9_8, kernel-64k 5.14.0-687.60.1.el9_8, kernel-core 5.14.0-687.60.1.el9_8, kernel-tools 5.14.0-687.60.1.el9_8, kernel-modules 5.14.0-687.60.1.el9_8, kernel-64k-core 5.14.0-687.60.1.el9_8, +27 more
    fixed: vendor fix RHSA-2026:87805
  • Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.68.1.el10_2, kernel-64k 6.12.0-211.68.1.el10_2, kernel-core 6.12.0-211.68.1.el10_2, kernel-tools 6.12.0-211.68.1.el10_2, kernel-modules 6.12.0-211.68.1.el10_2, kernel-64k-core 6.12.0-211.68.1.el10_2, +28 more
    fixed: vendor fix RHSA-2026:88477
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-687.60.1.el9_8, kernel-debuginfo-common-s390x 5.14.0-687.60.1.el9_8, kernel-debuginfo-common-x86_64 5.14.0-687.60.1.el9_8, kernel-debuginfo-common-aarch64 5.14.0-687.60.1.el9_8, kernel-debuginfo-common-ppc64le 5.14.0-687.60.1.el9_8
    fixed: vendor fix RHSA-2026:87805
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.68.1.el10_2, kernel-debuginfo-common-s390x 6.12.0-211.68.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.68.1.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.68.1.el10_2, kernel-debuginfo-common-ppc64le 6.12.0-211.68.1.el10_2 Red Hat Enterprise Linux Hidden (v. 10) kernel-modules-internal 6.12.0-211.68.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.68.1.el10_2
    fixed: vendor fix RHSA-2026:88477
show 5 more
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-687.60.1.el9_8, kernel-rt-64k 5.14.0-687.60.1.el9_8, kernel-rt-core 5.14.0-687.60.1.el9_8, kernel-rt-modules 5.14.0-687.60.1.el9_8, kernel-rt-64k-core 5.14.0-687.60.1.el9_8, kernel-rt-debug-core 5.14.0-687.60.1.el9_8, +14 more
    fixed: vendor fix RHSA-2026:87805
  • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.68.1.el10_2, kernel-rt-64k 6.12.0-211.68.1.el10_2, kernel-rt-core 6.12.0-211.68.1.el10_2, kernel-rt-modules 6.12.0-211.68.1.el10_2, kernel-rt-64k-core 6.12.0-211.68.1.el10_2, kernel-rt-debug-core 6.12.0-211.68.1.el10_2, +14 more
    fixed: vendor fix RHSA-2026:88477
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-687.60.1.el9_8, kernel-rt-core 5.14.0-687.60.1.el9_8, kernel-rt-modules 5.14.0-687.60.1.el9_8, kernel-rt-debug-core 5.14.0-687.60.1.el9_8, kernel-rt-modules-core 5.14.0-687.60.1.el9_8, kernel-rt-debug-modules 5.14.0-687.60.1.el9_8, +4 more
    fixed: vendor fix RHSA-2026:87805
  • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.68.1.el10_2, kernel-rt-core 6.12.0-211.68.1.el10_2, kernel-rt-modules 6.12.0-211.68.1.el10_2, kernel-rt-debug-core 6.12.0-211.68.1.el10_2, kernel-rt-modules-core 6.12.0-211.68.1.el10_2, kernel-rt-debug-modules 6.12.0-211.68.1.el10_2, +4 more
    fixed: vendor fix RHSA-2026:88477
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
23 d ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.