CVE-2024-42274

What it actually does

The flaw is a race condition deadlock (AB/BA lock inversion) between snd_pcm_stream_lock_irq in snd_pcm_status64 and snd_pcm_stream_lock_irqsave in snd_pcm_period_elapsed when the process-context workqueue was removed from amdtp_domain_stream_pcm_pointer and update_pcm_pointers, allowing a tasklet to contend for the ALSA substream lock and freeze the system on RME Fireface 800 hardware.

Why it matters to the business

Systems using affected Linux kernels with FireWire audio devices can experience sudden freezes during normal audio operations, leading to downtime, lost work, and the need for immediate kernel updates or workarounds; the 44 downstream dependents increase the scope of impacted environments.

How an attack unfolds

An attacker with local access triggers ALSA PCM operations on affected FireWire hardware; concurrent calls to snd_pcm_status64 and snd_pcm_period_elapsed compete for the substream lock via tasklet and IRQ paths, resulting in deadlock without any external network or remote steps required. Mentioned 2024 zero-day campaigns and Linux kernel uninitialized-resource or out-of-bounds issues illustrate the broader targeting of similar kernel surfaces by espionage and financially motivated actors.

How to fix it

Revert the problematic commit by updating to a kernel containing the fix that restores the process-context workqueue for period-elapse events; apply the exact fixed versions listed for any downstream packages such as jQuery 3.4.0 where applicable and test audio functionality post-upgrade.

How to confirm the fix worked

Confirm the presence of the reverted commit in the running kernel source or package changelog; reproduce ALSA operations with the affected hardware under load and verify absence of deadlock or system freeze.

Typical attack path

1. Obtain local shell or user context on a Linux system with RME Fireface 800 or similar FireWire audio device
2. Initiate ALSA PCM stream activity that invokes snd_pcm_status64 and snd_pcm_period_elapsed concurrently
3. Trigger the AB/BA lock contention between process and tasklet contexts
4. Cause system freeze via deadlock on the substream lock

How to detect it

Review kernel logs for tasklet_unlock_spin_wait and ohci_flush_iso_completions stack traces coinciding with ALSA period-elapsed events; look for sudden system freezes during audio playback or status queries on FireWire devices. Threat actor mentions indicate monitoring for broader Linux kernel exploitation patterns.

What your security team should do

• Prioritize kernel updates on all systems with FireWire audio hardware due to the deadlock regression since 5.14
• Audit environments for RME Fireface 800 or equivalent devices and schedule testing of the ALSA stack
• Monitor EPSS trend (stable at ~0.0017) and any new exploitation reports even though not currently in KEV
• Apply fixes to the 44 downstream dependents where package versions align with the listed jQuery 3.4.0 updates