CVE-2024-46798

What it actually does

Use-after-free in snd_soc_pcm_runtime during suspend when snd_pcm_suspend_all accesses a freed object because substream->runtime is not cleared after kfree.

Why it matters to the business

System crashes or potential local code execution on suspend in affected Linux kernels, disrupting operations and requiring urgent patching across server and device fleets.

How an attack unfolds

An attacker with local access triggers audio subsystem suspend paths that free snd_soc_pcm_runtime objects; subsequent access in snd_pcm_suspend_all reads freed memory, enabling use-after-free exploitation for privilege escalation or denial of service.

How to fix it

Update Linux kernel to commit 993b60c7f93fa1d8ff296b58f646a867e945ae89 or later stable releases that ensure substream->runtime is set to NULL after kfree.

How to confirm the fix worked

Confirm kernel sources contain the NULL assignment after kfree in the relevant dapm suspend path and test suspend/resume cycles with KASAN enabled to verify absence of UAF reports.

Typical attack path

1. Obtain local access on target system
2. Configure or trigger audio device suspend
3. Invoke snd_soc_suspend path during system sleep
4. Trigger snd_pcm_suspend_all to access freed runtime object
5. Leverage UAF for memory corruption or control flow hijack

How to detect it

Inspect kernel logs for KASAN use-after-free reports referencing snd_pcm_suspend_all and snd_soc_suspend during suspend events; correlate with systemd-sleep or similar suspend processes.

• BUG: KASAN: use-after-free in snd_pcm_suspend_all
• snd_pcm_suspend_all+0x1a8/0x270
• snd_soc_suspend+0x19c/0x4e0

What your security team should do

• Prioritize kernel upgrades to the fixed commit on all affected systems
• Monitor for suspend-related kernel panics in logs
• Apply defense-in-depth with kernel hardening features such as KASAN in testing environments
• Review audio subsystem usage in custom kernels for additional exposure