CVE-2024-42089

What it actually does

NULL pointer dereference in fsl_asoc_card probe when priv->pdev is used before assignment in fsl_asoc_card_audmux_init, caused by zero-initialized priv struct.

Why it matters to the business

Kernel crash or system instability possible during audio device initialization on affected Linux systems; widespread kernel update required across many distributions and embedded devices.

How an attack unfolds

An attacker with local access loads or triggers the fsl-asoc-card driver during boot or device probe; the uninitialized pdev causes dereference in dev_err paths, leading to panic. Listed threat actors have targeted similar kernel uninitialized resource issues in espionage and financial campaigns.

How to fix it

Update Linux kernel to commit ae81535ce2503aabc4adab3472f4338070cdeb6a or later stable version containing the fix; rebuild and deploy updated kernel packages across all affected systems.

How to confirm the fix worked

Confirm kernel source contains the pdev assignment moved to start of probe function; test driver probe with and without audmux errors to verify no crash occurs.

Typical attack path

1. Gain local code execution or physical access on target Linux system
2. Trigger loading of fsl-asoc-card audio driver via hardware or module load
3. Cause fsl_asoc_card_audmux_init to execute before pdev assignment
4. Trigger NULL dereference resulting in kernel panic or denial of service

How to detect it

Review kernel logs for oops or NULL pointer dereference messages during audio card probe; examine boot logs for fsl_asoc_card initialization failures.

What your security team should do

• Prioritize kernel upgrade to fixed commit on all production systems using fsl-asoc-card
• Monitor for audio driver initialization failures post-update
• Apply updates within standard patch windows given low EPSS and no KEV listing