Xu Yang

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a NULL module pointer assignment at card initialization in the ALSA core of the Linux kernel. This can lead to a missing module reference up/down at device open/close, resulting in a race with code execution after module removal. The problem occurs when the sound core is built-in while the driver is a module. The commit 81033c6b584b introduced a WARN ON() for a NULL module pointer passed at snd card object creation. To address the bug, the assignment of card->module is moved out of ifdef. The WARN ON() is still wrapped with ifdef because the module can be really NULL when all sound drivers are built-in. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.8.0-rc5-next-20240220-05616-g52728c567a55 **Description** The issue is related to a double-free problem in the `tcpm port unregister pd()` function. When unregistering pd capabilities in tcpm, KASAN captures a double-free issue. The root cause is that the same capability is freed twice, first by `pd capabilities release()` and then explicitly by `tcpm port unregister pd()`. This can lead to a denial of service or other unspecified impact. **Recommendations** To fix the issue, remove the `kree()` call from `tcpm port unregister pd()`. At the moment, there is no information about a newer version that contains a fix for this vulnerability.