CVE-2024-38615

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.37

Description: The issue is related to the cpufreq component of the Linux kernel, where the exit() callback is optional and should not be called without checking a valid pointer first. Additionally, the freq table pointer must be cleared even if the exit() callback is not present. There is also a mention of a vulnerability in the ALSA component related to improper input validation in the snd timer start1() function, which could allow an attacker to cause a denial of service.

Recommendations: To resolve the issue, update the Linux kernel to version 6.6.37 or later. As a temporary workaround, consider disabling the vulnerable cpufreq component until a patch is available. Restrict access to the ALSA component to minimize the risk of exploitation. Avoid using the vulnerable snd timer start1() function until the issue is resolved.