CVE-2024-35842

What it actually does

Missing NULL check on the normal_link field in sof_conn_stream entries allows dereference of a null pointer in the MediaTek ASoC SOF driver, resulting in a kernel panic on SoCs that support only SOF audio paths.

Why it matters to the business

Unexpected system crashes on affected Linux kernels can interrupt audio-dependent workloads, reduce device availability, and require emergency reboots or kernel updates, especially on Android and embedded platforms using MediaTek chips.

How an attack unfolds

An attacker with the ability to trigger audio subsystem initialization on a vulnerable kernel (for example via crafted user-space audio APIs or during boot on MT8188-class hardware) causes the driver to dereference a null normal_link pointer, crashing the kernel.

How to fix it

Update the Linux kernel to the commit cad471227a37c0c7c080bfc9ed01b53750e82afe or later stable releases that contain the NULL check for normal_link; rebuild and deploy the fixed kernel on all affected MediaTek-based systems.

How to confirm the fix worked

Verify the presence of the NULL-pointer guard around normal_link dereference in the sof-common.c source after the patch; boot test on MT8188-class hardware and confirm no kernel panic occurs when only SOF paths are used.

Typical attack path

1. Gain local access or execute code that initializes the ALSA/SOF audio stack
2. Trigger enumeration of sof_conn_stream entries that lack a normal_link string
3. Cause the unchecked pointer dereference during stream connection setup
4. Kernel oops/panic terminates the system or allows further local privilege escalation attempts

How to detect it

Review kernel logs for oops or panic messages originating from the ASoC mediatek sof-common driver during audio initialization; correlate with boot or audio service start times on affected hardware.

What your security team should do

• Prioritize kernel upgrades on all MediaTek Android and embedded devices within the next maintenance window
• Monitor vendor firmware releases that incorporate the referenced commit
• Add kernel crash and oops logging to existing telemetry to detect similar NULL-deref issues