Security readout for executives and security teams
Plain-English summary
Certain Linux systems using Qualcomm audio driver code may make a branch decision using an uninitialized pointer after receiving an invalid interface ID. This creates undefined behavior that could affect security or stability. Exploitation requires local, low-privileged access and high complexity. The supplied sources document no attacks in the wild.
Executive priority
Address through the high-severity kernel patch cycle, accelerating Qualcomm-based multi-user systems with untrusted local accounts. The local, high-complexity conditions and lack of documented exploitation do not indicate an internet-wide emergency, but affected asset ownership and vendor patch status should be established promptly.
Technical view
In sound/soc/qcom/lpass-cdc-dma.c, __lpass_get_dmactl_handle can leave dmactl uninitialized when dai_id is invalid. Its null check may then evaluate a garbage value. The fix initializes dmactl to NULL. CVSS 3.1 is 7.0: local access, high complexity, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact.
Likely exposure
Potential exposure is limited to Linux hosts whose kernels include and exercise the Qualcomm LPASS CDC DMA ASoC path. The bundle marks 5.18, 6.6.21, 6.7.9, and 6.8 affected, but also contains ambiguous version entries. Distribution backports can change status, so confirm exposure at package level.
Exploitation context
The CVSS vector requires local access and low privileges, with high attack complexity and no user interaction. The bundle reports no KEV listing, and the cited sources do not claim active exploitation or provide evidence of a working exploit. The defect was identified through static analysis.
Researcher notes
Static analysis reported an uninitialized branch condition at lpass-cdc-dma.c line 275. Evidence confirms the defect and NULL-initialization correction, but does not establish input reachability, the resulting memory operation, a proof of concept, or branch-specific fixed-version mapping. Treat the CVSS impacts as assessed potential, not proof of realized compromise.
Mitigation direction
- Apply a supported kernel release or vendor package containing the applicable upstream stable fix.
- Check distribution advisories for backported fixes before relying on upstream version numbers.
- Limit untrusted local access on potentially affected systems until patch status is confirmed.
Validation and detection
- Inventory kernel and distribution package versions across Qualcomm-based Linux assets.
- Confirm whether the Qualcomm LPASS CDC DMA ASoC code is built, loaded, or used.
- Map each package to vendor advisories or the three cited stable commits.
- Review kernel and audio-driver logs for unexplained faults; their absence does not prove safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26799 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9LinuxCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H2.53.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
6.2MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/99adc8b4d2f38bf0d06483ec845bc48f60c3f8cfCVE reference, Linux
- https://git.kernel.org/stable/c/d5a7726e6ea62d447b79ab5baeb537ea6bdb225bCVE reference, Linux
- https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769eeCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.