CVE-2024-38628

What it actually does

Use-after-free in Linux kernel USB gadget u_audio module where control pointers are dereferenced after the controls have been freed during gadget unbind, due to a race condition.

Why it matters to the business

Systems running affected Linux kernels that expose USB audio gadget functionality may experience kernel crashes, memory corruption, or potential arbitrary code execution during device unbind or hot-unplug events, leading to service disruption or full system compromise.

How an attack unfolds

An attacker with local or physical access triggers rapid gadget bind/unbind sequences or concurrent audio control operations during USB gadget teardown; the race allows use of dangling pointers to freed control structures, enabling memory manipulation or escalation.

How to fix it

Update the Linux kernel to the commit 89e66809684485590ea0b32c3178e42cba36ac09 or later stable releases that retain control IDs instead of raw pointers.

How to confirm the fix worked

Verify the running kernel contains commit 89e66809684485590ea0b32c3178e42cba36ac09; test by exercising USB gadget bind/unbind under load and confirm absence of use-after-free warnings in kernel logs.

Typical attack path

1. Gain access to a system exposing USB gadget audio functionality
2. Trigger concurrent gadget unbind operations while audio controls are in use
3. Exploit the window between free and subsequent pointer dereference to corrupt kernel memory
4. Leverage resulting corruption for denial of service or privilege escalation

How to detect it

Review kernel logs for u_audio, gadget, or use-after-free warnings around USB device unbind events; inspect for crashes or panics coinciding with gadget teardown.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all systems using USB gadget audio
• Disable USB gadget functionality where not required until patched
• Monitor kernel logs for u_audio related warnings during device hotplug events