CVE-2024-38628: usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uaudio: Fix race condition use of controls after free during gadget unbind.
Hang on to the control IDs instead of pointers since those are correctly handled with locks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38628?
The severity of CVE-2024-38628 is classified as medium due to the potential use-after-free condition affecting the Linux kernel.
How do I fix CVE-2024-38628?
To fix CVE-2024-38628, update to the patched versions of the Linux kernel, which include 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.13-1.
Which versions of the Linux kernel are affected by CVE-2024-38628?
CVE-2024-38628 affects various versions prior to the fixed releases, including those below 5.10.223-1 and 6.12.13-1.
What components of the Linux kernel does CVE-2024-38628 impact?
CVE-2024-38628 impacts the USB gadget subsystem, specifically related to audio controls functionality.
Is there a known exploit for CVE-2024-38628?
As of now, there are no publicly available exploits for CVE-2024-38628.