Executive brief
The TAS2781 HDA audio driver in the Linux kernel had a race condition where an asynchronous firmware loading callback could run after the driver was being unbound, operating on data structures that were being torn down. This could lead to kernel memory corruption or crash. The fix ensures the firmware callback is cancelled or completed before the driver removes its audio controls and DSP state.
Technical details
The vulnerability is a use-after-free condition in the TAS2781 HDA I2C and SPI drivers. The drivers queue firmware loading asynchronously via request_firmware_nowait() during component bind, but the callback operates on driver-private HDA state including codec_lock. When component unbind occurs, controls and DSP state are removed immediately, and later device removal tears down the private data. If the async firmware callback runs after unbind has started, it accesses freed or invalid kernel memory. The fix adds request_firmware_nowait_cancel() calls in the unbind path to synchronize or cancel pending firmware callbacks before tearing down driver state. No network access or user interaction is required—the race condition occurs during normal driver lifecycle transitions.
Affected products
- Linux Linux kernel multiple versions (patches applied to linux-5.10.y through linux-7.2.y and rolling branches)
Timeline
- 2026-09-04: disclosed
- 2026-05-06: patched: Upstream fix committed; stable backports merged July 2026