CVE-2024-40964: ALSA: hda: cs35l41: Possible null pointer dereference in cs35l41_hda_unbind()
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda: cs35l41: Possible null pointer dereference in cs35l41hdaunbind()
The cs35l41hdaunbind() function clears the hdacomponent entry matching it's index and then dereferences the codec pointer held in the first element of the hdacomponent array, this is an issue when the device index was 0.
Instead use the codec pointer stashed in the cs35l41hda structure as it will still be valid.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40964?
CVE-2024-40964 has a medium severity level due to the potential for a null pointer dereference in the Linux kernel.
How do I fix CVE-2024-40964?
To mitigate CVE-2024-40964, update to the latest patched versions of the Linux kernel available from your distribution.
Which versions of the Linux kernel are affected by CVE-2024-40964?
CVE-2024-40964 affects Linux kernel versions between 6.6 and 6.9.7, along with several 6.10 release candidates.
Can CVE-2024-40964 cause system crashes?
Yes, due to the null pointer dereference, CVE-2024-40964 can potentially lead to system crashes or instability.
Is there a known exploit for CVE-2024-40964?
As of now, there are no publicly disclosed exploits specifically targeting CVE-2024-40964.