{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-26799","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-19T14:20:24.179Z","datePublished":"2024-04-04T08:20:27.888Z","dateUpdated":"2026-08-05T11:27:20.557Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:27:20.557Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: Fix uninitialized pointer dmactl\n\nIn the case where __lpass_get_dmactl_handle is called and the driver\nid dai_id is invalid the pointer dmactl is not being assigned a value,\nand dmactl contains a garbage value since it has not been initialized\nand so the null check may not work. Fix this to initialize dmactl to\nNULL. One could argue that modern compilers will set this to zero, but\nit is useful to keep this initialized as per the same way in functions\n__lpass_platform_codec_intf_init and lpass_cdc_dma_daiops_hw_params.\n\nCleans up clang scan build warning:\nsound/soc/qcom/lpass-cdc-dma.c:275:7: warning: Branch condition\nevaluates to a garbage value [core.uninitialized.Branch]"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The only way to invoke `lpass_cdc_dma_daiops_trigger()` is an `SNDRV_PCM_IOCTL_DROP`/`PAUSE` ioctl on a local `/dev/snd/pcmC*D*` node, routed through `soc_pcm_trigger()` → `snd_soc_pcm_dai_trigger()`. No packet, adjacent-network, or physical path reaches this DAI operation.\nAC:H - The uninitialized `dmactl` is only consumed when `__lpass_get_dmactl_handle()` falls to its `default:` arm, which requires `cpu_dai->driver->id` to lie outside `LPASS_CDC_DMA_RX0…VA_TX8`; that id is a compile-time constant in the DAI table and the sole in-tree consumer (`lpass-sc7280.c`: ids 6, 19, 25) is fully covered. The attacker cannot influence which DAI table the kernel was built with, which is CVSS's \"conditions beyond the attacker's control.\"\nPR:L - Reaching the trigger op needs only an open PCM substream on a `root:audio` 0660 device node — no `capable()`, `CAP_SYS_ADMIN`, or any other check exists along `snd_pcm_ioctl` → `soc_pcm_trigger` → the DAI callback. A local unprivileged account with routine audio access (default for desktop and Chromebook sessions on this SoC) suffices.\nUI:N - The attacker opens the PCM device and issues the DROP/PAUSE ioctls entirely from their own process. No victim needs to play audio, mount anything, or take any action.\nS:U - The garbage pointer is dereferenced by kernel code operating on the kernel's own LPASS regmap, and all consequences stay within the kernel's security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - When the branch is taken, `dmactl` holds residual kernel-stack data that an attacker can prime via a preceding syscall at the same stack depth, and `dmactl->codec_enable` is then loaded as a `struct reg_field *` — an attacker-influenced read of arbitrary kernel memory feeding subsequent regmap state. Per the round-up rule this uncontrolled-pointer read is scored High rather than as a bounded leak.\nI:H - `regmap_fields_write(dmactl->codec_enable, id, LPAIF_DMACTL_ENABLE_OFF)` performs a write through a field descriptor obtained from the wild pointer, with `id` also left uninitialized as the field index, yielding writes to attacker-influenced register/memory locations. That is a memory-corruption primitive usable toward control-flow hijack, not a bounded modification.\nA:H - Dereferencing an uninitialized stack pointer that survives the `if (!dmactl)` guard produces an immediate oops in `regmap_fields_write()`, and a bad regmap field index can additionally program the LPASS DMA control block into an invalid state. Any such kernel oops or wedged audio DMA engine is a full availability loss."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/qcom/lpass-cdc-dma.c"],"versions":[{"version":"b81af585ea54ee9f749391e594ee9cbd44061eae","lessThan":"99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf","status":"affected","versionType":"git"},{"version":"b81af585ea54ee9f749391e594ee9cbd44061eae","lessThan":"d5a7726e6ea62d447b79ab5baeb537ea6bdb225b","status":"affected","versionType":"git"},{"version":"b81af585ea54ee9f749391e594ee9cbd44061eae","lessThan":"1382d8b55129875b2e07c4d2a7ebc790183769ee","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/qcom/lpass-cdc-dma.c"],"versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","status":"unaffected","versionType":"semver"},{"version":"6.6.21","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.9","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.6.21"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.7.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf"},{"url":"https://git.kernel.org/stable/c/d5a7726e6ea62d447b79ab5baeb537ea6bdb225b"},{"url":"https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769ee"}],"title":"ASoC: qcom: Fix uninitialized pointer dmactl","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","lang":"en","description":"CWE-noinfo Not enough information"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.2,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-04-04T15:07:57.653434Z","id":"CVE-2024-26799","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-11-01T14:54:06.205Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T00:14:13.565Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/99adc8b4d2f38bf0d06483ec845bc48f60c3f8cf","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/d5a7726e6ea62d447b79ab5baeb537ea6bdb225b","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/1382d8b55129875b2e07c4d2a7ebc790183769ee","tags":["x_transferred"]}]}]}}