CVE-2024-26799

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26799", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.179Z", "datePublished": "2024-04-04T08:20:27.888Z", "dateUpdated": "2026-10-30T12:17:51.599Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:17:51.599Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: Fix uninitialized pointer dmactl\n\nIn the case where __lpass_get_dmactl_handle is called and the driver\nid dai_id is invalid the pointer dmactl is not being assigned a value,\nand dmactl contains a garbage value since it has not been initialized\nand so the null check may not work. Fix this to initialize dmactl to\nNULL. One could argue that modern compilers will set this to zero, but\nit is useful to keep this initialized as per the same way in functions\n__lpass_platform_codec_intf_init and lpass_cdc_dma_daiops_hw_params.\n\nCleans up clang scan build warning:\nsound/soc/qcom/lpass-cdc-dma.c:275:7: warning: Branch condition\nevaluates to a garbage value [core.uninitialized.Branch]"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The only way to invoke `lpass_cdc_dma_daiops_trigger()` is an `SNDRV_PCM_IOCTL_DROP`/`PAUSE` ioctl on a local `/dev/snd/pcmC*D*` node, routed through `soc_pcm_trigger()` \u2192 `snd_soc_pcm_dai_trigger()`. No packet, adjacent-network, or physical path reaches this DAI operation.\nAC:H - The uninitialized `dmactl` is only consumed when `__lpass_get_dmactl_handle()` falls to its `default:` arm, which requires `cpu_dai->driver->id` to lie outside `LPASS_CDC_DMA_RX0\u2026VA_TX8`; that id is a compile-time constant in the DAI table and the sole in-tree consumer (`lpass-sc7280.c`: ids 6, 19, 25) is fully covered. The attacker cannot influence which DAI table the kernel was built with, which is CVSS's \"conditions beyond the attacker's control.\"\nPR:L - Reaching the trigger op needs only an open PCM substream on a `root:audio` 0660 device node \u2014 no `capable()`, `CAP_SYS_ADMIN`, or any other check exists along `snd_pcm_ioctl` \u2192 `soc_pcm_trigger` \u2192 the DAI callback. A local unprivileged account with routine audio access (default for desktop and Chromebook sessions on this SoC) suffices.\nUI:N - The attacker opens the PCM device and issues the DROP/PAUSE ioctls entirely from their own process. No victim needs to play audio, mount anything, or take any action.\nS:U - The garbage pointer is dereferenced by kernel code operating on the kernel's own LPASS regmap, and all consequences stay within the kernel's security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - When the branch is taken, `dmactl` holds residual kernel-stack data that an attacker can prime via a preceding syscall at the same stack depth, and `dmactl->codec_enable` is then loaded as a `struct reg_field *` \u2014 an attacker-influenced read of arbitrary kernel memory feeding subsequent regmap state. Per the round-up rule this uncontrolled-pointer read is scored High rather than as a bounded leak.\nI:H - `regmap_fields_write(dmactl->codec_enable, id, LPAIF_DMACTL_ENABLE_OFF)` performs a write through a field descriptor obtained from the wild pointer, with `id` also left uninitialized as the field index, yielding writes to attacker-influenced register/memory locations. That is a memory-corruption primitive usable toward control-flow hijack, not a bounded modification.\nA:H - Dereferencing an uninitialized stack pointer that survives the `if (!dmactl)` guard produces an immediate oops in `regmap_fields_write()`, and a bad regmap field index can additionally program the LPASS DMA control block into an invalid state. Any such kernel oops or wedged audio DMA engine is a full availability loss."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/qcom/lpass-cdc-dma.c"], "versions": [{"version": "b81af585ea54ee9f749391e594ee9cbd44061eae", "lessThan": "3301f5513e668d47514f32b0fea39e85b1152010", "status": "affected", "versionType": "git"}, {"version": "b81af585ea54ee9f749391e594ee9cbd44061eae", "lessThan": "99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf", "status": "affected", "versionType": "git"}, {"version": "b81af585ea54ee9f749391e594ee9cbd44061eae", "lessThan": "d5a7726e6ea62d447b79ab5baeb537ea6bdb225b", "status": "affected", "versionType": "git"}, {"version": "b81af585ea54ee9f749391e594ee9cbd44061eae", "lessThan": "1382d8b55129875b2e07c4d2a7ebc790183769ee", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/qcom/lpass-cdc-dma.c"], "versions": [{"version": "5.18", "status": "affected"}, {"version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.21", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.9", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.6.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.7.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3301f5513e668d47514f32b0fea39e85b1152010"}, {"url": "https://git.kernel.org/stable/c/99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf"}, {"url": "https://git.kernel.org/stable/c/d5a7726e6ea62d447b79ab5baeb537ea6bdb225b"}, {"url": "https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769ee"}], "title": "ASoC: qcom: Fix uninitialized pointer dmactl", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-04-04T15:07:57.653434Z", "id": "CVE-2024-26799", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-01T14:54:06.205Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.565Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d5a7726e6ea62d447b79ab5baeb537ea6bdb225b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769ee", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d5a7726e6ea62d447b79ab5baeb537ea6bdb225b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769ee", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.565Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-26799", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-04T15:07:57.653434Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:21.943Z"}}], "cna": {"title": "ASoC: qcom: Fix uninitialized pointer dmactl", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The only way to invoke `lpass_cdc_dma_daiops_trigger()` is an `SNDRV_PCM_IOCTL_DROP`/`PAUSE` ioctl on a local `/dev/snd/pcmC*D*` node, routed through `soc_pcm_trigger()` \u2192 `snd_soc_pcm_dai_trigger()`. No packet, adjacent-network, or physical path reaches this DAI operation.\nAC:H - The uninitialized `dmactl` is only consumed when `__lpass_get_dmactl_handle()` falls to its `default:` arm, which requires `cpu_dai->driver->id` to lie outside `LPASS_CDC_DMA_RX0\u2026VA_TX8`; that id is a compile-time constant in the DAI table and the sole in-tree consumer (`lpass-sc7280.c`: ids 6, 19, 25) is fully covered. The attacker cannot influence which DAI table the kernel was built with, which is CVSS's \"conditions beyond the attacker's control.\"\nPR:L - Reaching the trigger op needs only an open PCM substream on a `root:audio` 0660 device node \u2014 no `capable()`, `CAP_SYS_ADMIN`, or any other check exists along `snd_pcm_ioctl` \u2192 `soc_pcm_trigger` \u2192 the DAI callback. A local unprivileged account with routine audio access (default for desktop and Chromebook sessions on this SoC) suffices.\nUI:N - The attacker opens the PCM device and issues the DROP/PAUSE ioctls entirely from their own process. No victim needs to play audio, mount anything, or take any action.\nS:U - The garbage pointer is dereferenced by kernel code operating on the kernel's own LPASS regmap, and all consequences stay within the kernel's security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - When the branch is taken, `dmactl` holds residual kernel-stack data that an attacker can prime via a preceding syscall at the same stack depth, and `dmactl->codec_enable` is then loaded as a `struct reg_field *` \u2014 an attacker-influenced read of arbitrary kernel memory feeding subsequent regmap state. Per the round-up rule this uncontrolled-pointer read is scored High rather than as a bounded leak.\nI:H - `regmap_fields_write(dmactl->codec_enable, id, LPAIF_DMACTL_ENABLE_OFF)` performs a write through a field descriptor obtained from the wild pointer, with `id` also left uninitialized as the field index, yielding writes to attacker-influenced register/memory locations. That is a memory-corruption primitive usable toward control-flow hijack, not a bounded modification.\nA:H - Dereferencing an uninitialized stack pointer that survives the `if (!dmactl)` guard produces an immediate oops in `regmap_fields_write()`, and a bad regmap field index can additionally program the LPASS DMA control block into an invalid state. Any such kernel oops or wedged audio DMA engine is a full availability loss."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b81af585ea54ee9f749391e594ee9cbd44061eae", "lessThan": "3301f5513e668d47514f32b0fea39e85b1152010", "versionType": "git"}, {"status": "affected", "version": "b81af585ea54ee9f749391e594ee9cbd44061eae", "lessThan": "99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf", "versionType": "git"}, {"status": "affected", "version": "b81af585ea54ee9f749391e594ee9cbd44061eae", "lessThan": "d5a7726e6ea62d447b79ab5baeb537ea6bdb225b", "versionType": "git"}, {"status": "affected", "version": "b81af585ea54ee9f749391e594ee9cbd44061eae", "lessThan": "1382d8b55129875b2e07c4d2a7ebc790183769ee", "versionType": "git"}], "programFiles": ["sound/soc/qcom/lpass-cdc-dma.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"status": "unaffected", "version": "0", "lessThan": "5.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.21", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.9", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["sound/soc/qcom/lpass-cdc-dma.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3301f5513e668d47514f32b0fea39e85b1152010"}, {"url": "https://git.kernel.org/stable/c/99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf"}, {"url": "https://git.kernel.org/stable/c/d5a7726e6ea62d447b79ab5baeb537ea6bdb225b"}, {"url": "https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769ee"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: Fix uninitialized pointer dmactl\n\nIn the case where __lpass_get_dmactl_handle is called and the driver\nid dai_id is invalid the pointer dmactl is not being assigned a value,\nand dmactl contains a garbage value since it has not been initialized\nand so the null check may not work. Fix this to initialize dmactl to\nNULL. One could argue that modern compilers will set this to zero, but\nit is useful to keep this initialized as per the same way in functions\n__lpass_platform_codec_intf_init and lpass_cdc_dma_daiops_hw_params.\n\nCleans up clang scan build warning:\nsound/soc/qcom/lpass-cdc-dma.c:275:7: warning: Branch condition\nevaluates to a garbage value [core.uninitialized.Branch]"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.21", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.9", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "5.18"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:17:51.599Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26799", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:17:51.599Z", "dateReserved": "2024-02-19T14:20:24.179Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-04T08:20:27.888Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/soc/qcom/lpass-cdc-dma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3301f5513e668d47514f32b0fea39e85b1152010", "status": "affected", "version": "b81af585ea54ee9f749391e594ee9cbd44061eae", "versionType": "git"}, {"lessThan": "99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf", "status": "affected", "version": "b81af585ea54ee9f749391e594ee9cbd44061eae", "versionType": "git"}, {"lessThan": "d5a7726e6ea62d447b79ab5baeb537ea6bdb225b", "status": "affected", "version": "b81af585ea54ee9f749391e594ee9cbd44061eae", "versionType": "git"}, {"lessThan": "1382d8b55129875b2e07c4d2a7ebc790183769ee", "status": "affected", "version": "b81af585ea54ee9f749391e594ee9cbd44061eae", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/soc/qcom/lpass-cdc-dma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"lessThan": "5.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.21", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E53CB5C6-7BC3-4304-8B6F-53F9F5E348F8", "versionEndExcluding": "6.6.21", "versionStartIncluding": "5.18", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C538467-EDA0-4A9A-82EB-2925DE9FF827", "versionEndExcluding": "6.7.9", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*", "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*", "matchCriteriaId": "62075ACE-B2A0-4B16-829D-B3DA5AE5CC41", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*", "matchCriteriaId": "A780F817-2A77-4130-A9B7-5C25606314E3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*", "matchCriteriaId": "AEB9199B-AB8F-4877-8964-E2BA95B5F15C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: Fix uninitialized pointer dmactl\n\nIn the case where __lpass_get_dmactl_handle is called and the driver\nid dai_id is invalid the pointer dmactl is not being assigned a value,\nand dmactl contains a garbage value since it has not been initialized\nand so the null check may not work. Fix this to initialize dmactl to\nNULL. One could argue that modern compilers will set this to zero, but\nit is useful to keep this initialized as per the same way in functions\n__lpass_platform_codec_intf_init and lpass_cdc_dma_daiops_hw_params.\n\nCleans up clang scan build warning:\nsound/soc/qcom/lpass-cdc-dma.c:275:7: warning: Branch condition\nevaluates to a garbage value [core.uninitialized.Branch]"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ASoC: qcom: corrige el puntero no inicializado dmactl. En el caso de que se llame a __lpass_get_dmactl_handle y el ID del controlador dai_id no sea v\u00e1lido, al puntero dmactl no se le asigna un valor y dmactl contiene un valor basura. ya que no se ha inicializado y, por lo tanto, es posible que la verificaci\u00f3n nula no funcione. Solucione esto para inicializar dmactl a NULL. Se podr\u00eda argumentar que los compiladores modernos establecer\u00e1n esto en cero, pero es \u00fatil mantenerlo inicializado de la misma manera en las funciones __lpass_platform_codec_intf_init y lpass_cdc_dma_daiops_hw_params. Limpia la advertencia de compilaci\u00f3n de escaneo clang: sound/soc/qcom/lpass-cdc-dma.c:275:7: advertencia: la condici\u00f3n de rama se eval\u00faa como un valor basura [core.uninitialized.Branch]"}], "id": "CVE-2024-26799", "lastModified": "2026-10-30T13:17:21.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26799", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-04-04T15:07:57.653434Z", "version": "2.0.3"}}]}, "published": "2024-04-04T09:15:08.953", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769ee"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3301f5513e668d47514f32b0fea39e85b1152010"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d5a7726e6ea62d447b79ab5baeb537ea6bdb225b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769ee"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d5a7726e6ea62d447b79ab5baeb537ea6bdb225b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-824"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ASoC: qcom: Fix uninitialized pointer dmactl", "id": "2273432", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2273432"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-822", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nASoC: qcom: Fix uninitialized pointer dmactl\nIn the case where __lpass_get_dmactl_handle is called and the driver\nid dai_id is invalid the pointer dmactl is not being assigned a value,\nand dmactl contains a garbage value since it has not been initialized\nand so the null check may not work. Fix this to initialize dmactl to\nNULL. One could argue that modern compilers will set this to zero, but\nit is useful to keep this initialized as per the same way in functions\n__lpass_platform_codec_intf_init and lpass_cdc_dma_daiops_hw_params.\nCleans up clang scan build warning:\nsound/soc/qcom/lpass-cdc-dma.c:275:7: warning: Branch condition\nevaluates to a garbage value [core.uninitialized.Branch]", "A vulnerability was found in the Qualcomm ASoC (ALSA System on Chip) driver for the Linux kernel, where an uninitialized pointer (`dmactl`) could be used in certain conditions. This issue occurs when an invalid driver ID (`dai_id`) is encountered, leading to potential use of uninitialized memory."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-26799", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26799\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26799\nhttps://lore.kernel.org/linux-cve-announce/2024040403-CVE-2024-26799-1fd6@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{}