SB2026090572 - Race condition in Linux kernel codecs side-codecs

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-80872)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a race condition that accesses driver-private state during teardown.

The vulnerability exists due to a race condition in the TAS2781 HDA I2C and SPI drivers when an asynchronous firmware callback runs after component unbinding has begun. A local user can initiate component unbinding while an asynchronous firmware request is pending to cause a race condition that accesses driver-private state during teardown.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5367e2ad14f0ae9350a7aaf2e77c87de39a43ae9
• https://git.kernel.org/stable/c/da9e3be9cf31d7138d23e9e2f7ba1c102ef09f07
• https://git.kernel.org/stable/c/f8272331da877eec8fe8e89a1e98e6a710e12490