A use-after-free vulnerability in the Linux kernel ALSA hda cs35l41 driver affects multiple kernel branches, posing a severe risk of local privilege escalation and system compromise.

This vulnerability is a use-after-free flaw caused by improper firmware load work teardown and unbind handling in the cs35l41_hda ALSA driver, requiring low local privileges to exploit.

A successful exploit allows an authenticated local attacker to achieve high confidentiality, integrity, and availability impacts. This can lead to total system compromise, arbitrary code execution within kernel space, and potential data leakage. The CVSS score of 7.8 reflects the severity of local privilege escalation within core operating system components.

Immediate Action: Update the Linux kernel to version 6.12.97, 6.18.39, 7.1.4, or later depending on the active release branch.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unusual driver teardown errors related to the ALSA subsystem.

Compensating Controls: Restrict local shell access and harden system permissions to prevent untrusted local users from executing arbitrary code or loading unauthorized kernel modules.

Public Exploit Available: No

Administrators must prioritize updating vulnerable Linux kernel packages to the patched versions immediately. Applying the latest kernel patches removes the unsafe driver state dereferences and prevents potential local system takeovers.