CVE-2026-80872: ALSA: hda/tas2781: Cancel async firmware request at unbind
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/tas2781: Cancel async firmware request at unbind
TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with requestfirmwarenowait(). The firmware loader keeps the callback module pinned and holds a device reference, but the callback still uses driver-private HDA state.
Component unbind removes controls and DSP state immediately. Later device removal tears down the TAS2781 private data, including codeclock. If the async firmware callback runs after unbind has started, it can operate on state that is being torn down.
Cancel or synchronize the async firmware request before removing controls and DSP state. A queued callback is cancelled, and an already-running callback is allowed to finish before unbind continues.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
Systems using the Linux ALSA HDA TAS2781 driver over I2C or SPI are exposed when the driver has queued asynchronous RCA firmware loading and the component is unbound or removed before the firmware callback completes.
What event is required to trigger the issue?
The asynchronous firmware callback must run after component unbind has started, while driver-private HDA state, controls, DSP state, or related private data is being removed. The issue is tied to the timing of firmware loading relative to device/component teardown.
What is the relevant mitigation if the fix cannot be applied immediately?
Avoid unbinding or removing the TAS2781 component while an asynchronous firmware request may still be pending. The resolved behavior cancels queued callbacks and waits for an already-running callback to finish before teardown proceeds.