CVE-2024-26654

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs

The dreamcastcard->timer could schedule the spu_dma_work and the

spu_dma_work could also arm the dreamcastcard->timer.

When the snd_pcm_substream is closing, the aica_channel will be

deallocated. But it could still be dereferenced in the worker

thread. The reason is that del_timer() will return directly

regardless of whether the timer handler is running or not and

the worker could be rescheduled in the timer handler. As a result,

the UAF bug will happen. The racy situation is shown below:

(Thread 1) | (Thread 2)

snd_aicapcm_pcm_close() |

... | run_spu_dma() //worker

| mod_timer()

flush_work() |

del_timer() | aica_period_elapsed() //timer

kfree(dreamcastcard->channel) | schedule_work()

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References