CVE-2024-56532

ALSA: us122l: Use snd_card_free_when_closed() at disconnection

State: Published
Severity: 5.5 Medium
Published: Dec 27, 2024
Updated: May 11, 2026
Reserved: Dec 27, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: us122l: Use snd_card_free_when_closed() at disconnection

The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup.

An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close.

The loop of us122l->mmap_count check is dropped as well. The check is useless for the asynchronous operation with *_when_closed().

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-667 Improper Locking

Affected Products

Product	Versions
LinuxLinux	030a07e441296c372f946cd4065b5d831d8dc40c to before 020cbc4d7414f0962004213e2b7bc5cc607e9ec7Affected 030a07e441296c372f946cd4065b5d831d8dc40c to before 75f418b249d84021865eaa59515d3ed9b75ce4d6Affected 030a07e441296c372f946cd4065b5d831d8dc40c to before bf0aa35a7cb8602cccf2387712114e836f65c154Affected 030a07e441296c372f946cd4065b5d831d8dc40c to before 9a48bd2184b142c92a4e17eac074c61fcf975bc9Affected 030a07e441296c372f946cd4065b5d831d8dc40c to before bc778ad3e495333eebda36fe91d5b2c93109cc16Affected 030a07e441296c372f946cd4065b5d831d8dc40c to before 2938dd2648522336133c151dd67bb9bf01cbd390Affected 030a07e441296c372f946cd4065b5d831d8dc40c to before 9b27924dc8d7f8a8c35e521287d4ccb9a006e597Affected 030a07e441296c372f946cd4065b5d831d8dc40c to before 9d5c530e4d70f64b1114f2cc29ac690ba7ac4a38Affected 030a07e441296c372f946cd4065b5d831d8dc40c to before b7df09bb348016943f56b09dcaafe221e3f73947Affected
LinuxLinux	2.6.28Affected before 2.6.28Not affected 4.19.325 through 4.19.Not affected 5.4.287 through 5.4.Not affected 5.10.231 through 5.10.Not affected 5.15.174 through 5.15.Not affected 6.1.120 through 6.1.Not affected 6.6.64 through 6.6.Not affected 6.11.11 through 6.11.Not affected 6.12.2 through 6.12.Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

030a07e441296c372f946cd4065b5d831d8dc40c to before 020cbc4d7414f0962004213e2b7bc5cc607e9ec7Affected
030a07e441296c372f946cd4065b5d831d8dc40c to before 75f418b249d84021865eaa59515d3ed9b75ce4d6Affected
030a07e441296c372f946cd4065b5d831d8dc40c to before bf0aa35a7cb8602cccf2387712114e836f65c154Affected
030a07e441296c372f946cd4065b5d831d8dc40c to before 9a48bd2184b142c92a4e17eac074c61fcf975bc9Affected
030a07e441296c372f946cd4065b5d831d8dc40c to before bc778ad3e495333eebda36fe91d5b2c93109cc16Affected
030a07e441296c372f946cd4065b5d831d8dc40c to before 2938dd2648522336133c151dd67bb9bf01cbd390Affected
030a07e441296c372f946cd4065b5d831d8dc40c to before 9b27924dc8d7f8a8c35e521287d4ccb9a006e597Affected
030a07e441296c372f946cd4065b5d831d8dc40c to before 9d5c530e4d70f64b1114f2cc29ac690ba7ac4a38Affected
030a07e441296c372f946cd4065b5d831d8dc40c to before b7df09bb348016943f56b09dcaafe221e3f73947Affected

LinuxLinux

2.6.28Affected
before 2.6.28Not affected
4.19.325 through 4.19.*Not affected
5.4.287 through 5.4.*Not affected
5.10.231 through 5.10.*Not affected
5.15.174 through 5.15.*Not affected
6.1.120 through 6.1.*Not affected
6.6.64 through 6.6.*Not affected
6.11.11 through 6.11.*Not affected
6.12.2 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.