LiveActive security incident?Get immediate response
CVE Record

CVE-2024-38635: soundwire: cadence: fix invalid PDI offset

In the Linux kernel, the following vulnerability has been resolved: soundwire: cadence: fix invalid PDI offset For some reason, we add an offset to the PDI, presumably to skip the PDI0 and PDI1 which are reserved for BPT. This code is however completely wrong and leads to an out-of-bounds access. We were just lucky so far since we used only a couple of PDIs and remained within the PDI array bounds. A Fixes: tag is not provided since there are no known platforms where the out-of-bounds would be accessed, and the initial code had problems as well. A follow-up patch completely removes this useless offset.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-38635 is a Linux kernel bug in the Cadence SoundWire driver. A wrong offset can cause an out-of-bounds access. The source notes no known platforms where the bad access is reached, so business urgency depends on whether affected kernels and relevant SoundWire hardware are present.

Executive priority

Treat as a targeted kernel maintenance item, not an emergency from current evidence. Prioritize validation in fleets with SoundWire audio hardware, embedded Linux, or Siemens exposure, then roll into standard kernel patch cycles unless vendor guidance raises urgency.

Technical view

The Cadence SoundWire code added an offset to the PDI index, apparently to skip reserved PDI0/PDI1 entries. Kernel maintainers state this logic is wrong and can access beyond the PDI array. Stable kernel commits address the issue by fixing/removing the invalid offset logic.

Likely exposure

Exposure is most plausible on Linux systems using affected kernel builds with the Cadence SoundWire driver and compatible hardware. The bundle lists Linux kernel versions including 5.4.278, 5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.9.4, and 6.10 as affected.

Exploitation context

No source in the bundle reports active exploitation, and the CVE is not listed as KEV. The kernel description says there are no known platforms where the out-of-bounds access would be reached, which lowers confidence in practical exploitability from the supplied evidence.

Researcher notes

The main uncertainty is reachability. The upstream note explicitly says no known platforms access the out-of-bounds path. Focus analysis on driver configuration, hardware presence, and downstream patch status rather than assuming broad Linux exposure.

Mitigation direction

  • Review kernel vendor guidance for CVE-2024-38635.
  • Apply Linux kernel updates containing the referenced stable fixes.
  • Prioritize systems with Cadence SoundWire hardware or enabled drivers.
  • Track Siemens guidance if using affected Siemens products.

Validation and detection

  • Inventory Linux kernel versions across managed systems.
  • Check whether Cadence SoundWire driver support is enabled or loaded.
  • Compare deployed kernels against vendor advisories and stable fix commits.
  • Confirm downstream distribution packages include the referenced kernel fixes.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-38635 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
3ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2unaffected
LinuxLinux5.4.278, 5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.9.4, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.