CVE-2026-64481High· 7.0▾ TwilightA flaw was found in the Linux kernel's ALSA sound driver for the cs35l41 component. This vulnerability occurs because the driver fails to properly remove controls and cancel firmware load work during component unbinding or device removal, …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.1%
Last analysed / modified upstream
7.8 → 7
0.1% → 0.2%
A flaw was found in the Linux kernel's ALSA sound driver for the cs35l41 component. This vulnerability occurs because the driver fails to properly remove controls and cancel firmware load work during component unbinding or device removal, especially when firmware autostart is disabled. This can lead to a worker attempting to access driver data that is no longer valid after teardown, resulting in memory corruption. An attacker with local access could potentially exploit this to cause a denial of service or escalate privileges.
kernel: ALSA: hda/cs35l41: Fix firmware load work teardown — rated Moderate by Red Hat. Released 2026-07-25, updated 2026-10-23.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.
Because of this proactive approach, a patch may be associa… https://access.redhat.com/errata/RHSA-2026:88477 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.
Because of this proactive approach, a patch may be associa… https://access.redhat.com/errata/RHSA-2026:87805
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-68448High· 7.0kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)
CVE-2026-80536High· 8.4In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlog_recover_do_reg_buffer() replays each dirty region described by a buffer log item's bitmap into the buffer read fo…
CVE-2026-68245High· 7.0kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)
CVE-2026-72317Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpc_clnt across the TLS connect_worker The TLS connect path has a use-after-free: nothing pins the upper rpc_clnt across the delayed connect_worker
CVE-2026-74509High· 8.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix advertising data UAFs hci_find_adv_instance() returns an adv_info pointer that is valid only while hdev->lock is held
CVE-2026-80714Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists