LiveActive security incident?Get immediate response
CVE Record

CVE-2024-56531: ALSA: caiaq: Use snd_card_free_when_closed() at disconnection

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup. An easy workaround is to replace snd_card_free() with snd_card_free_when_closed(). This variant returns immediately while the release of resources is done asynchronously by the card device release at the last close. This patch also splits the code to the disconnect and the free phases; the former is called immediately at the USB disconnect callback while the latter is called from the card destructor.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux ALSA USB audio driver can stall kernel work when a caiaq device disconnects while file descriptors remain open. The disconnect path waits too long for users to close the device, potentially causing a soft lockup and disrupting the host. The supplied CVSS rating is 7.8, but practical exposure depends on use of the affected driver and hardware path.

Executive priority

Treat as a focused high-priority kernel maintenance issue, not an internet-wide emergency. Expedite remediation for endpoints or specialist systems using caiaq USB audio; handle other systems through the normal kernel patch cycle after confirming whether the driver is reachable.

Technical view

The caiaq USB disconnect callback called snd_card_free(), which waits for open file descriptors to close and can block upper-layer USB ioctls. The correction uses snd_card_free_when_closed() for immediate return and asynchronous cleanup after the final close, while separating disconnect and resource-free phases. This is classified as CWE-667, improper locking.

Likely exposure

Exposure is concentrated on Linux systems running an affected kernel where the ALSA caiaq driver and relevant USB audio device path are used. Systems without that driver or device workflow are less likely to be practically exposed. Distribution kernels may contain backported fixes despite version numbers, so patch status must be verified with the distributor.

Exploitation context

The supplied CVSS vector describes a local, low-complexity condition requiring low privileges and no user interaction. Triggering relates to USB device disconnection while descriptors remain open. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit.

Researcher notes

The failure concerns blocking work inside a USB disconnect callback rather than a demonstrated remote entry point. The cited change replaces synchronous teardown with deferred release and separates disconnect from destruction. Although the supplied CVSS claims high confidentiality, integrity, and availability impacts, the narrative specifically documents blocking ioctls and possible soft lockup; broader impacts are not established here.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable stable fix.
  • Check distribution security guidance because kernel fixes may be backported without changing upstream version numbering.
  • Prioritize systems that load the caiaq driver and use associated USB audio devices.
  • Where updating is delayed, reduce access to the affected device workflow according to organizational policy.

Validation and detection

  • Inventory running kernels and identify systems with the ALSA caiaq driver present or loaded.
  • Map vendor kernel packages to the cited stable commits or distribution security advisories.
  • Confirm the installed kernel uses asynchronous card cleanup in the caiaq disconnect path.
  • Review kernel logs for soft lockups associated with USB audio disconnection.
  • After updating, verify normal disconnect behavior without prolonged kernel stalls.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-667: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-56531 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
2ADP providers
12Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-56531Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux523f1dce37434a9a6623bf46e7893e2b4b10ac3c, 523f1dce37434a9a6623bf46e7893e2b4b10ac3c, 523f1dce37434a9a6623bf46e7893e2b4b10ac3c, 523f1dce37434a9a6623bf46e7893e2b4b10ac3c, 523f1dce37434a9a6623bf46e7893e2b4b10ac3c, 523f1dce37434a9a6623bf46e7893e2b4b10ac3c, 523f1dce37434a9a6623bf46e7893e2b4b10ac3c, 523f1dce37434a9a6623bf46e7893e2b4b10ac3c, 523f1dce37434a9a6623bf46e7893e2b4b10ac3cunaffected
LinuxLinux2.6.22, 0, 4.19.325, 5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.64, 6.11.11, 6.12.2, 6.13affected
Weakness

CWE details

CWE-667

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-667 · source CWE mapping

Improper Locking

Improper Locking represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs