CVE-2024-41037

What it actually does

Null pointer dereference in the HDA DMA suspend path when hw_params_upon_resume triggers hda_link_dma_cleanup before hda_ipc4_post_trigger, clearing link_substream and passing NULL to the IPC trigger handler.

Why it matters to the business

Kernel panic or system crash on suspend with active audio streams on Intel HDA platforms, causing unexpected downtime and potential loss of unsaved work on affected Linux systems.

How an attack unfolds

An attacker with local shell access starts an audio stream then initiates suspend, exercising the buggy call chain through hda_dsp_set_hw_params_upon_resume to trigger the null dereference.

How to fix it

Update the Linux kernel to a version containing commit 8246bbf818ed7b8d5afc92b951e6d562b45c2450 or later equivalent stable releases.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit, then reproduce suspend with an active stream and verify absence of the null dereference panic.

Typical attack path

1. Obtain local user access
2. Activate an audio playback or capture stream
3. Trigger system suspend entry

How to detect it

Inspect kernel logs and dmesg for oops/panic entries containing hda_dai_suspend, hda_ipc4_post_trigger, or null pointer dereference during suspend events.

What your security team should do

• Apply the kernel fix containing commit 8246bbf818ed7b8d5afc92b951e6d562b45c2450 at the earliest maintenance window
• Test suspend/resume cycles with audio workloads on representative hardware
• Review kernel panic logs for hda_dai_suspend related oops after updates