CVE-2024-50292

What it actually does

NULL pointer dereference triggered in dma_release_channel during stm32_spdifrx_remove when ctrl_chan DMA request fails, because the pointer remains non-null yet invalid on the error path.

Why it matters to the business

Kernel crash or system instability on STM32-based audio hardware, leading to unexpected reboots and loss of audio functionality; low ecosystem prevalence limits widespread operational disruption.

How an attack unfolds

An attacker or misbehaving process forces a DMA channel request failure during driver probe on affected STM32 hardware; the subsequent remove path then passes an invalid pointer to dma_release_channel, causing the kernel NULL dereference observed in the call trace.

How to fix it

Update the Linux kernel to a version containing the fix that releases the DMA channel only after confirming the pointer is valid; apply the patch that guards the release in stm32_spdifrx_remove.

How to confirm the fix worked

Confirm the presence of the pointer-validity check before dma_release_channel in the stm32_spdifrx_remove function and verify that probe error paths no longer produce the NULL dereference stack trace.

Typical attack path

1. Load or probe the snd_soc_stm32_spdifrx module under conditions that cause DMA ctrl_chan request to fail with -19
2. Trigger the error path that calls stm32_spdifrx_remove without validating the channel pointer
3. Execute dma_release_channel on the dangling pointer, resulting in kernel oops at virtual address 0x3d

How to detect it

Search kernel logs and dmesg for the exact call trace containing dma_release_channel and stm32_spdifrx_remove, plus preceding dma_request_slave_channel error -19 messages.

• Unable to handle kernel NULL pointer dereference at virtual address 000000000000003d
• dma_release_channel+0x24/0x100
• stm32_spdifrx_remove+0x24/0x60 [snd_soc_stm32_spdifrx]
• dma_request_slave_channel error -19

What your security team should do

• Prioritize kernel updates on STM32 platforms that use the spdifrx audio controller
• Monitor kernel logs for dma_request_slave_channel errors followed by NULL pointer oops involving snd_soc_stm32_spdifrx
• Test audio driver load/unload sequences in lab environments matching production hardware before broad deployment