CVE-2024-42089: ASoC: fsl-asoc-card: set priv->pdev before using it
In the Linux kernel, the following vulnerability has been resolved:
ASoC: fsl-asoc-card: set priv->pdev before using it
priv->pdev pointer was set after being used in fslasoccardaudmuxinit(). Move this assignment at the start of the probe function, so sub-functions can correctly use pdev through priv.
fslasoccardaudmuxinit() dereferences priv->pdev to get access to the dev struct, used with deverr macros. As priv is zero-initialised, there would be a NULL pointer dereference. Note that if priv->dev is dereferenced before assignment but never used, for example if there is no error to be printed, the driver won't crash probably due to compiler optimisations.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42089?
CVE-2024-42089 is considered a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-42089?
To fix CVE-2024-42089, upgrade to the patched versions of the Linux kernel, namely 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.
Which Linux kernel versions are affected by CVE-2024-42089?
CVE-2024-42089 affects multiple kernel versions, specifically those from 3.18 up to 6.10-rc5.
Is CVE-2024-42089 exploited in the wild?
As of now, there are no public reports indicating that CVE-2024-42089 has been actively exploited in the wild.
What are the consequences of not addressing CVE-2024-42089?
Ignoring CVE-2024-42089 may expose affected systems to potential vulnerabilities that could lead to privilege escalation or other security risks.