In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/tas2781: Cancel async firmware request at unbind
TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with request_firmware_nowait(). The firmware loader keeps the callback module pinned and holds a device reference, but the callback still uses driver-private HDA state.
Component unbind removes controls and DSP state immediately. Later device removal tears down the TAS2781 private data, including codec_lock. If the async firmware callback runs after unbind has started, it can operate on state that is being torn down.
Cancel or synchronize the async firmware request before removing controls and DSP state. A queued callback is cancelled, and an already-running callback is allowed to finish before unbind continues.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-awsUpgrade linux-image-gcp-7.0Upgrade linux-image-gcp-64kUpgrade linux-image-generic-hwe-26.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-azure-7.0Upgrade linux-image-oracle-7.0Upgrade linux-image-generic-7.0Upgrade linux-image-7.0.0-1013-oracle-64kUpgrade linux-image-realtimeUpgrade linux-image-oem-26.04aUpgrade linux-image-oem-26.04Upgrade linux-image-virtual-hwe-26.04Upgrade linux-image-gke-64kUpgrade linux-image-7.0.0-1008-gkeUpgrade linux-image-gke-64k-7.0Upgrade linux-image-azure-fde-7.0Upgrade linux-image-oracleUpgrade linux-image-realtime-64kUpgrade linux-image-azure-fdeUpgrade linux-image-7.0.0-38-genericUpgrade linux-image-aws-64k-7.0Upgrade linux-image-realtime-7.0Upgrade linux-image-gke-7.0Upgrade linux-image-7.0.0-1014-awsUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-7.0.0-1014-gcpUpgrade linux-image-generic-64k-7.0Upgrade linux-image-gke-64k-hwe-26.04Upgrade linux-image-7.0.0-1017-azureUpgrade linux-image-virtualUpgrade linux-image-7.0.0-1014-aws-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-64kUpgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-7.0.0-1008-gke-64kUpgrade linux-image-genericUpgrade linux-image-gcp-64k-7.0Upgrade linux-image-aws-64kUpgrade linux-image-7.0.0-1015-oemUpgrade linux-image-aws-7.0Upgrade linux-image-realtime-hwe-26.04Upgrade linux-image-azure-lts-26.04Upgrade linux-image-7.0.0-1014-gcp-64kUpgrade linux-image-virtual-7.0Upgrade linux-image-oracle-64kUpgrade linux-image-gkeUpgrade linux-image-7.0.0-38-generic-64kUpgrade linux-image-gke-hwe-26.04Upgrade linux-image-oracle-64k-7.0Upgrade linux-image-ibm-7.0Upgrade linux-image-7.0.0-38-realtimeUpgrade linux-image-ibmUpgrade linux-image-7.0.0-1016-azure-fdeUpgrade linux-image-7.0.0-1015-ibmUpgrade linux-image-gcpUpgrade linux-image-azure-fde-lts-26.04Upgrade linux-image-azureUpgrade linux-image-7.0.0-38-realtime-64kUpgrade linux-image-7.0.0-1013-oracleUpgrade linux-image-realtime-64k-7.0Upgrade linux-image-oem-7.0 | Oct 7, 2026 | Oct 6, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub