CVE-2024-46798

ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object

State: Published
Severity: 7.8 High
Published: Sep 18, 2024
Updated: Aug 5, 2026
Reserved: Sep 11, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object

When using kernel with the following extra config,

- CONFIG_KASAN=y - CONFIG_KASAN_GENERIC=y - CONFIG_KASAN_INLINE=y - CONFIG_KASAN_VMALLOC=y - CONFIG_FRAME_WARN=4096

kernel detects that snd_pcm_suspend_all() access a freed 'snd_soc_pcm_runtime' object when the system is suspended, which leads to a use-after-free bug:

[ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270 [ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330

[ 52.047785] Call trace: [ 52.047787] dump_backtrace+0x0/0x3c0 [ 52.047794] show_stack+0x34/0x50 [ 52.047797] dump_stack_lvl+0x68/0x8c [ 52.047802] print_address_description.constprop.0+0x74/0x2c0 [ 52.047809] kasan_report+0x210/0x230 [ 52.047815] __asan_report_load1_noabort+0x3c/0x50 [ 52.047820] snd_pcm_suspend_all+0x1a8/0x270 [ 52.047824] snd_soc_suspend+0x19c/0x4e0

The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before making any access. So we need to always set 'substream->runtime' to NULL everytime we kfree() it.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 to before 993b60c7f93fa1d8ff296b58f646a867e945ae89Affected a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 to before 8ca21e7a27c66b95a4b215edc8e45e5d66679f9fAffected a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 to before 3033ed903b4f28b5e1ab66042084fbc2c48f8624Affected a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 to before fe5046ca91d631ec432eee3bdb1f1c49b09c8b5eAffected a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 to before 5d13afd021eb43868fe03cef6da34ad08831ad6dAffected a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 to before 6a14fad8be178df6c4589667efec1789a3307b4eAffected a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 to before b4a90b543d9f62d3ac34ec1ab97fc5334b048565Affected
LinuxLinux	5.4Affected before 5.4Not affected 5.4.284 through 5.4.Not affected 5.10.226 through 5.10.Not affected 5.15.167 through 5.15.Not affected 6.1.110 through 6.1.Not affected 6.6.51 through 6.6.Not affected 6.10.10 through 6.10.Not affected 6.11 and laterNot affected

Product

Versions

LinuxLinux

a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 to before 993b60c7f93fa1d8ff296b58f646a867e945ae89Affected
a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 to before 8ca21e7a27c66b95a4b215edc8e45e5d66679f9fAffected
a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 to before 3033ed903b4f28b5e1ab66042084fbc2c48f8624Affected
a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 to before fe5046ca91d631ec432eee3bdb1f1c49b09c8b5eAffected
a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 to before 5d13afd021eb43868fe03cef6da34ad08831ad6dAffected
a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 to before 6a14fad8be178df6c4589667efec1789a3307b4eAffected
a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 to before b4a90b543d9f62d3ac34ec1ab97fc5334b048565Affected

LinuxLinux

5.4Affected
before 5.4Not affected
5.4.284 through 5.4.*Not affected
5.10.226 through 5.10.*Not affected
5.15.167 through 5.15.*Not affected
6.1.110 through 6.1.*Not affected
6.6.51 through 6.6.*Not affected
6.10.10 through 6.10.*Not affected
6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.