LiveActive security incident?Get immediate response
CVE Record

CVE-2024-46798: ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object

In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object When using kernel with the following extra config, - CONFIG_KASAN=y - CONFIG_KASAN_GENERIC=y - CONFIG_KASAN_INLINE=y - CONFIG_KASAN_VMALLOC=y - CONFIG_FRAME_WARN=4096 kernel detects that snd_pcm_suspend_all() access a freed 'snd_soc_pcm_runtime' object when the system is suspended, which leads to a use-after-free bug: [ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270 [ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330 [ 52.047785] Call trace: [ 52.047787] dump_backtrace+0x0/0x3c0 [ 52.047794] show_stack+0x34/0x50 [ 52.047797] dump_stack_lvl+0x68/0x8c [ 52.047802] print_address_description.constprop.0+0x74/0x2c0 [ 52.047809] kasan_report+0x210/0x230 [ 52.047815] __asan_report_load1_noabort+0x3c/0x50 [ 52.047820] snd_pcm_suspend_all+0x1a8/0x270 [ 52.047824] snd_soc_suspend+0x19c/0x4e0 The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before making any access. So we need to always set 'substream->runtime' to NULL everytime we kfree() it.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux audio subsystem object may be used after its memory is freed when an affected system suspends. The demonstrated result is an unsafe kernel memory access that can destabilize or crash the system. The CVSS assessment also allows serious confidentiality and integrity impact, but the supplied sources do not demonstrate those outcomes.

Executive priority

Use accelerated maintenance for affected endpoints, appliances, or embedded systems that use ASoC and suspend, especially where untrusted users have local accounts. This is high severity but not supported as an internet-wide emergency: available evidence indicates local access, and no active exploitation is cited.

Technical view

The ASoC DAPM path frees an snd_soc_pcm_runtime-related runtime object without consistently clearing substream->runtime. During suspension, snd_pcm_suspend_all() can dereference that stale pointer, causing a use-after-free. The Linux stable fixes set substream->runtime to NULL whenever its memory is freed, allowing the existing NULL check to prevent access.

Likely exposure

Exposure is limited to affected Linux kernels where the relevant ASoC audio and suspend path is exercised. The source bundle identifies affected release lines spanning 5.4 through 6.11, but its version representation does not provide sufficiently clear branch boundaries. KASAN exposed the defect during testing; the evidence does not establish that KASAN is required for vulnerability.

Exploitation context

The CVSS vector describes a local, low-privileged attack requiring no user interaction. The supplied bundle marks the CVE as absent from KEV and provides no evidence of active exploitation, a public exploit, remote reachability, or a demonstrated path from the memory error to code execution.

Researcher notes

The observed primitive is a one-byte read through a stale runtime pointer during suspension. The sources establish the lifetime error and corrective NULL assignment, but not attacker control, reliable exploitation, code execution, or precise affected-package boundaries across distributions. Branch-specific stable commits and distribution advisories should drive verification.

Mitigation direction

  • Apply a vendor-supported kernel update incorporating the applicable Linux stable fix, then reboot.
  • Consult distribution advisories to map the affected branch and corrected package precisely.
  • Restrict untrusted local account access until remediation is complete.
  • Do not treat KASAN configuration as mitigation; it was used to detect the defect.

Validation and detection

  • Record each system's running kernel version and determine whether it uses the ASoC audio stack.
  • Confirm the package changelog or vendor advisory addresses CVE-2024-46798 or the corresponding stable commit.
  • After rebooting, verify the running kernel matches the corrected package.
  • On a controlled test system, exercise suspend and resume while monitoring for kernel use-after-free reports.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-46798 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-46798Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa72706ed8208ac3f72d1c3ebbc6509e368b0dcb0, a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0, a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0, a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0, a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0, a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0, a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0unaffected
LinuxLinux5.4, 0, 5.4.284, 5.10.226, 5.15.167, 6.1.110, 6.6.51, 6.10.10, 6.11affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.