In the Linux kernel the TAS2781 HDA audio codec driver schedules firmware loading through request_firmware_nowait. The callback keeps the module pinned and holds a reference to the device, but it accesses driver‑private state that is torn down when the device unbinds. If the asynchronous callback runs after unbinding begins, it can operate on state that has already been freed or invalidated. This results in a use‑after‑free condition that can lead to kernel memory corruption, a crash, or a potential privilege elevation scenario. The flaw is tied to the component’s dynamic firmware request mechanism and the order in which the unbind routine cleans up resources.

All Linux kernel builds that include the ALSA HDA tas2781 driver for I2C or SPI codecs. Specific kernel versions are not listed in the advisory; any deployment that loads this driver for TAS2781 hardware is potentially affected.

No EPSS score is available and the vulnerability is not in CISA KEV. The CVSS score is unspecified in the advisory, but the nature of a use‑after‑free in kernel space implies a severe impact if exploited. Attackers would need local or privileged access to trigger firmware loading and timed unbinding. The exploit path requires controlling the device lifecycle, which is generally restricted to privileged users or malware running with elevated rights. While no publicly known exploit exists, the condition could be leveraged to crash the kernel or, with additional techniques, to gain kernel privilege.