CVE-2024-53239

ALSA: 6fire: Release resources at card release

State: Published
Severity: 7.8 High
Published: Dec 27, 2024
Updated: Aug 5, 2026
Reserved: Nov 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: 6fire: Release resources at card release

The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()).

For avoid potential UAFs, move the release of resources to the card's private_free instead of the manual call of usb6fire_chip_destroy() at the USB disconnect callback.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before 74357d0b5cd3ef544752bc9f21cbeee4902fae6cAffected c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before 273eec23467dfbfbd0e4c10302579ba441fb1e13Affected c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before f2d06d4e129e2508e356136f99bb20a332ff1a00Affected c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before b889a7d68d7e76b8795b754a75c91a2d561d5e8cAffected c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before ea8cc56db659cf0ae57073e32a4735ead7bd7ee3Affected c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before b754e831a94f82f2593af806741392903f359168Affected c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before 0df7f4b5cc10f5adf98be0845372e9eef7bb5b09Affected c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before 57860a80f03f9dc69a34a5c37b0941ad032a0a8cAffected c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before a0810c3d6dd2d29a9b92604d682eacd2902ce947Affected
LinuxLinux	2.6.39Affected before 2.6.39Not affected 4.19.325 through 4.19.Not affected 5.4.287 through 5.4.Not affected 5.10.231 through 5.10.Not affected 5.15.174 through 5.15.Not affected 6.1.120 through 6.1.Not affected 6.6.64 through 6.6.Not affected 6.11.11 through 6.11.Not affected 6.12.2 through 6.12.Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before 74357d0b5cd3ef544752bc9f21cbeee4902fae6cAffected
c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before 273eec23467dfbfbd0e4c10302579ba441fb1e13Affected
c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before f2d06d4e129e2508e356136f99bb20a332ff1a00Affected
c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before b889a7d68d7e76b8795b754a75c91a2d561d5e8cAffected
c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before ea8cc56db659cf0ae57073e32a4735ead7bd7ee3Affected
c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before b754e831a94f82f2593af806741392903f359168Affected
c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before 0df7f4b5cc10f5adf98be0845372e9eef7bb5b09Affected
c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before 57860a80f03f9dc69a34a5c37b0941ad032a0a8cAffected
c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 to before a0810c3d6dd2d29a9b92604d682eacd2902ce947Affected

LinuxLinux

2.6.39Affected
before 2.6.39Not affected
4.19.325 through 4.19.*Not affected
5.4.287 through 5.4.*Not affected
5.10.231 through 5.10.*Not affected
5.15.174 through 5.15.*Not affected
6.1.120 through 6.1.*Not affected
6.6.64 through 6.6.*Not affected
6.11.11 through 6.11.*Not affected
6.12.2 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.