CVE-2024-40964

What it actually does

Null pointer dereference in cs35l41_hda_unbind() when clearing the hda_component entry at index 0 and then dereferencing the codec pointer from the first array element instead of the stashed pointer in the cs35l41_hda structure.

Why it matters to the business

May cause kernel crashes or system instability on Linux systems using affected Cirrus Logic audio hardware, leading to unexpected downtime and potential loss of audio functionality until reboot.

How an attack unfolds

An attacker with local access triggers device unbind operations on a system where the audio codec index is zero, causing the kernel to follow an invalid pointer and panic.

How to fix it

Update the Linux kernel to a patched version that uses the stashed codec pointer in cs35l41_hda_unbind instead of the array element.

How to confirm the fix worked

Confirm updated kernel version and inspect source for the corrected pointer usage in the unbind function; monitor for absence of related oops messages after device events.

Typical attack path

1. Locate a Linux system with the vulnerable cs35l41 HDA driver
2. Perform operations that invoke cs35l41_hda_unbind with index 0
3. Trigger null pointer dereference resulting in kernel panic

How to detect it

Examine kernel logs and dmesg output for null pointer dereference faults mentioning cs35l41_hda_unbind or hda_component array handling.

What your security team should do

• Prioritize kernel updates on systems with Cirrus Logic HDA audio
• Reboot after patching to load fixed driver
• Review kernel logs for audio-related crashes as a temporary detection measure