CVE-2023-52736

What it actually does

Unset of codec preset pointer during snd_hda_codec_cleanup_for_unbind allows null dereference on subsequent ASoC codec driver module reload without full device removal, because snd_hda_codec_device_new expects a valid snd_card pointer only after sound card probing.

Why it matters to the business

Audio stack instability and kernel crashes on systems using ASoC codec drivers, leading to downtime during module load/unload cycles or sound card unbind events; prevalence in Linux kernel git trees increases exposure for embedded and desktop audio hardware.

How an attack unfolds

An attacker triggers repeated ASoC sound card unbind and module reload sequences (via user-space audio reconfiguration or driver manipulation) to reach the cleanup path that clears the preset pointer, then forces a snd_hda_codec_device_new call that dereferences the now-null pointer, causing a kernel panic.

How to fix it

Update the Linux kernel to a version containing commit 7fc4e7191eae9d9325511e03deadfdb2224914f8 which prevents preset unset in snd_hda_codec_cleanup_for_unbind; rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Verify kernel source contains the fix commit or run uname -r against a distribution kernel built after 2024-05-21 that includes the change; test module reload/unbind cycles under ASoC to confirm no null dereference occurs.

Typical attack path

1. Identify system with ASoC ALSA codec drivers active
2. Perform sound card unbind without full codec device removal
3. Unload and reload the ASoC codec driver module
4. Trigger snd_hda_codec_device_new during re-probing
5. Cause null pointer dereference and kernel crash

How to detect it

Search kernel logs and dmesg for null pointer dereference oops mentioning snd_hda_codec_cleanup_for_unbind, hda_bind, or ASoC codec probe/remove paths around module unload events.

• snd_hda_codec_cleanup_for_unbind
• null-ptr-deref in ALSA hda codec
• ASoC codec driver module reload crash

What your security team should do

• Apply the kernel update containing commit 7fc4e7191eae9d9325511e03deadfdb2224914f8 immediately on audio-enabled systems
• Monitor for kernel oops in ALSA paths during driver reload operations
• Restrict unprivileged module loading where possible until patched