CVE-2024-36955

What it actually does

Missing fwnode_handle_put() call after device_get_named_child_node() in ALSA HDA Intel SoundWire ACPI code leaves a firmware node reference held, producing a kernel memory leak on every invocation of the affected path.

Why it matters to the business

Repeated triggering of the code path can gradually exhaust kernel memory, leading to degraded performance, forced reboots, or denial of service on Linux audio-enabled systems; urgency is low given the 0.24 % EPSS and lack of known exploitation or ransomware use.

How an attack unfolds

An attacker with local access repeatedly exercises the ALSA HDA intel-sdw-acpi initialization or ACPI child-node lookup paths (module load, device enumeration, or SoundWire controller probe) to accumulate unreleased references until memory pressure causes system instability; no named threat actors have been observed exploiting this issue.

How to fix it

Upgrade the Linux kernel to commit bd2d9641a39e6b5244230c4b41c4aca83b54b377 or later; apply the stable-tree patch that adds the missing fwnode_handle_put() call.

How to confirm the fix worked

Confirm the running kernel contains commit bd2d9641a39e6b5244230c4b41c4aca83b54b377; inspect the source of intel-sdw-acpi.c for the presence of fwnode_handle_put() immediately after each device_get_named_child_node() call; monitor kernel memory statistics for unexpected growth in firmware-node objects.

Typical attack path

1. Obtain local shell or user context on a vulnerable Linux kernel
2. Trigger repeated ALSA HDA SoundWire ACPI device enumeration or module reload cycles
3. Accumulate unreleased fwnode references until kernel memory is exhausted
4. Induce crash, OOM killer activity, or forced reboot

How to detect it

Search kernel logs and memory accounting for repeated allocation of fwnode_handle objects without corresponding release in the intel-sdw-acpi or ALSA HDA paths; correlate with device enumeration events or module load activity; no public exploitation artifacts are known.

What your security team should do

• Patch kernels to the fixed commit within normal maintenance windows
• Prioritize systems that frequently enumerate SoundWire or HDA devices
• Add kernel memory-leak monitoring to existing observability dashboards
• Review downstream distributions for backported fixes once they appear