CVE-2024-46849

What it actually does

Use-after-free in axg_card_add_link after dai_link reallocation in meson_card_reallocate_links allows read of freed slab memory.

Why it matters to the business

Local attackers can crash systems or escalate privileges on affected Linux kernels, risking downtime and unauthorized kernel access in environments using Meson AXG audio cards.

How an attack unfolds

An attacker with local access triggers module load of snd_soc_meson_axg_sound_card during init, causing meson_card_probe to call axg_card_add_link on already-freed dai_link memory after reallocation.

How to fix it

Upgrade the Linux kernel to a version containing commit a33145f494e6cb82f3e018662cc7c4febf271f22 which moves pad initialization after meson_card_reallocate_links.

How to confirm the fix worked

Confirm the fix by inspecting the axg-card source for pad pointer initialization occurring after the reallocation call, or verify the commit is present in the running kernel tree.

Typical attack path

1. Obtain local user access on a vulnerable system
2. Load or trigger probe of the meson axg sound card driver
3. Invoke meson_card_probe leading to axg_card_add_link
4. Access freed memory via stale pad pointer to read or corrupt kernel data

How to detect it

Search kernel logs and dmesg for KASAN slab-use-after-free reports citing axg_card_add_link during modprobe of snd_soc_meson_axg_sound_card.

• BUG: KASAN: slab-use-after-free in axg_card_add_link
• axg_card_add_link+0x76c/0x9bc
• meson_card_probe+0x344/0x3b8

What your security team should do

• Apply the referenced kernel commit or later stable release immediately
• Restrict unprivileged module loading via kernel parameters where feasible
• Monitor kernel logs for KASAN reports involving axg_card_add_link