The Linux kernel ALSA hda/cs35l41 driver created ALSA controls with private data pointing to the cs35l41_hda object and queued firmware load work that was not properly removed on component unbind. Device removal only cancelled the queued work if a certain initialization flag was true, which could be false if firmware autostart was disabled. This allowed a firmware load request to be queued before DSP initialization, and if the device was removed before the queued work executed, the worker could run after teardown, dereferencing invalid driver state. The fix involves tracking created controls to remove them on unbind, cancelling queued firmware load work unconditionally during device removal, and draining any queued requests to prevent callbacks from accessing invalid data.

Successful exploitation could lead to use-after-free conditions in kernel driver code, potentially causing system crashes or privilege escalation due to dereferencing invalid driver state. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. However, no known exploits are reported in the wild at this time.

A patch is available and should be applied by updating to the fixed Linux kernel versions listed in the Ubuntu security advisories USN-8726-1 and USN-8727-1. After applying the update, a system reboot is required. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow vendor instructions for updating kernel packages to versions 7.0.0-1006.7, 7.0.0-1011.11, 7.0.0-1012.12, 7.0.0-31.31, 7.0.0-31.31.1, or later as appropriate for your system.