CVE-2024-38605

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to a NULL module pointer assignment at card initialization in the ALSA core of the Linux kernel. This can lead to a missing module reference up/down at device open/close, resulting in a race with code execution after module removal. The problem occurs when the sound core is built-in while the driver is a module. The commit 81033c6b584b introduced a WARN ON() for a NULL module pointer passed at snd card object creation. To address the bug, the assignment of card->module is moved out of ifdef. The WARN ON() is still wrapped with ifdef because the module can be really NULL when all sound drivers are built-in.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.