The Linux kernel ALSA hda/cs35l41 driver created ALSA controls with private data pointing to the cs35l41_hda object. Firmware load controls could queue work (fw_load_work) that was not properly canceled if the component was unbound or the device removed before the work ran. Specifically, cs35l41_remove_dsp(), which cancels the work, is skipped if halo_initialized is false, allowing queued work to execute after teardown and dereference invalid driver state. The patch tracks created controls to remove them on unbind, preventing new callbacks from queuing work, and cancels any queued work unconditionally during device removal before runtime PM teardown.

If exploited, this vulnerability could lead to use-after-free or invalid pointer dereference in kernel space, potentially causing system instability or crashes. No known exploits in the wild have been reported. The impact is limited to systems using the affected ALSA hda/cs35l41 driver with specific firmware load conditions.

A fix has been implemented in the Linux kernel to track and remove ALSA controls on component unbind and to cancel any queued firmware load work during device removal. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed in this data; check the vendor or Linux kernel advisories for current remediation guidance.