PT-2024-9784 · Linux+6 · Linux Kernel+6
Xu Yang
·
Published
2024-05-22
·
Updated
2025-09-29
·
CVE-2024-38605
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
The issue is related to a NULL module pointer assignment at card initialization in the ALSA core of the Linux kernel. This can lead to a missing module reference up/down at device open/close, resulting in a race with code execution after module removal. The problem occurs when the sound core is built-in while the driver is a module. The commit 81033c6b584b introduced a WARN ON() for a NULL module pointer passed at snd card object creation. To address the bug, the assignment of card->module is moved out of ifdef. The WARN ON() is still wrapped with ifdef because the module can be really NULL when all sound drivers are built-in.
Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu