Riskcovery

CVE-2024-56533

ALSA: usx2y: Use snd_card_free_when_closed() at disconnection

State
Published
Severity
5.5 Medium
Published
Dec 27, 2024
Updated
May 11, 2026
Reserved
Dec 27, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usx2y: Use snd_card_free_when_closed() at disconnection

The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup.

An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 230cd5e24853ed4dd960461989b8ed0986d37a99 to before 24fe9f7ca83ec9acf765339054951f5cd9ae5c5dAffected
  • 230cd5e24853ed4dd960461989b8ed0986d37a99 to before befcca1777525e37c659b4129d8ac7463b07ef67Affected
  • 230cd5e24853ed4dd960461989b8ed0986d37a99 to before 7bd8838c0ea886679a32834fdcacab296d072fbeAffected
  • 230cd5e24853ed4dd960461989b8ed0986d37a99 to before e07605d855c4104d981653146a330ea48f6266edAffected
  • 230cd5e24853ed4dd960461989b8ed0986d37a99 to before ffbfc6c4330fc233698529656798bee44fea96f5Affected
  • 230cd5e24853ed4dd960461989b8ed0986d37a99 to before e869642a77a9b3b98b0ab2c8fec7af4385140909Affected
  • 230cd5e24853ed4dd960461989b8ed0986d37a99 to before dafb28f02be407e07a6f679e922a626592b481b0Affected
LinuxLinux
  • 2.6.13Affected
  • before 2.6.13Not affected
  • 5.10.231 through 5.10.*Not affected
  • 5.15.174 through 5.15.*Not affected
  • 6.1.120 through 6.1.*Not affected
  • 6.6.64 through 6.6.*Not affected
  • 6.11.11 through 6.11.*Not affected
  • 6.12.2 through 6.12.*Not affected
  • 6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.