CVE-2024-56532

What it actually does

The USB disconnect callback in the us122l ALSA driver calls snd_card_free() which synchronously waits for all file descriptors to close, potentially blocking upper-layer USB ioctls for an extended period and triggering a soft lockup.

Why it matters to the business

Systems using affected USB audio hardware may experience unexpected freezes or require reboots during device disconnection, increasing operational downtime and support burden on Linux deployments with high device churn.

How an attack unfolds

An attacker with local or physical access connects a us122l USB audio device, opens file descriptors to keep the card active, then triggers a USB disconnect; the synchronous free blocks USB handling long enough to induce a soft lockup, amplified in environments targeted by espionage or financially motivated campaigns exploiting Linux kernel flaws.

How to fix it

Upgrade the Linux kernel to a version containing commit 020cbc4d7414f0962004213e2b7bc5cc607e9ec7 or later; replace snd_card_free() with snd_card_free_when_closed() in the us122l disconnect handler and remove the mmap_count loop.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit or a backport; reproduce a USB disconnect under load and verify the handler returns immediately without blocking; inspect dmesg for absence of soft lockup warnings tied to us122l.

Typical attack path

1. Attach compatible USB audio device to a running Linux system
2. Open file descriptors via ALSA or mmap to hold references
3. Force or simulate USB disconnect while references remain open
4. Observe prolonged blocking in USB ioctl path leading to soft lockup

How to detect it

Search kernel logs for soft lockup or hung task messages referencing USB or ALSA during device removal events; correlate with us122l driver activity and USB disconnect traces in dmesg or journalctl around the time of reported hangs.

What your security team should do

• Prioritize kernel updates on systems exposing USB audio devices within the next maintenance window given 654 days since publication
• Monitor EPSS trend and any new exploit maturity signals before relaxing compensating controls
• Audit deployed kernels for the vulnerable us122l code path and schedule phased rollouts
• Restrict unprivileged USB device attachment where feasible until patches are applied