{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-64481 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-64481 is a high-severity use after free vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-64481 and fix it if it is affected.\n\nWhat it is: CVE-2026-64481 is a high-severity use after free vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-64481 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-64481/ (Markdown: https://insights.sbomify.com/CVE-2026-64481/index.md)","id":"CVE-2026-64481","markdown":"https://insights.sbomify.com/CVE-2026-64481/index.md","name":"CVE-2026-64481","record":{"aliases":["BELL-CVE-2026-64481","DEBIAN-CVE-2026-64481","GHSA-2c47-qrc2-3g99","ROOT-OS-DEBIAN-12-CVE-2026-64481","ROOT-OS-DEBIAN-13-CVE-2026-64481","ROOT-OS-UBUNTU-2204-CVE-2026-64481","UBUNTU-CVE-2026-64481"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","code_execution"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"A use-after-free in the Linux kernel's CS35L41 audio driver allows attackers to cause a crash or execute code if firmware autostart is disabled and the device is removed during work execution.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda/cs35l41: Fix firmware load work teardown\n\ncs35l41_hda creates ALSA controls whose private data points at the\ncs35l41_hda object. The firmware load control can also queue\nfw_load_work.\n\nThose controls are not removed on component unbind, and device remove\nonly cancels fw_load_work through cs35l41_remove_dsp(). That helper is\nskipped when halo_initialized is false. With firmware_autostart\ndisabled, a firmware load can be requested before the DSP has been\ninitialized. If the component or device is removed before the queued\nwork runs, the worker can run after teardown and dereference driver\nstate that is no longer valid.\n\nTrack the created controls and remove them on unbind so no new control\ncallback can reach the driver data or queue more work. Then cancel\nfw_load_work to drain any request that was already queued. Also cancel\nthe work unconditionally during device remove before runtime PM teardown.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ALSA: hda/cs35l41: Fix firmware load work teardown","id":"CVE-2026-64481","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"ALSA: gus: check snd_ctl_new1() return value","id":"CVE-2026-64482"},"packages":[],"prev":{"headline":"ALSA: ice1712: check snd_ctl_new1() return value","id":"CVE-2026-64480"},"products":["Linux"],"published":"2026-07-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel's CS35L41 audio driver allows attackers to cause a crash or execute code if firmware autostart is disabled and the device is removed during work execution.","url":"https://insights.sbomify.com/CVE-2026-64481/"}