NULL pointer dereference in Linux
CVE-2024-50105
In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: sc7280: Fix missing Soundwire runtime stream alloc Commit 15c7fab0e047 ("ASoC: qcom: Move Soundwire runtime stream alloc to soundcards") moved the allocation of Soundwire stream runtime from the Qualcomm Soundwire driver to each individual machine sound card driver, except that it forgot to update SC7280 card. Just like for other Qualcomm sound cards using Soundwire, the card driver should allocate and release the runtime. Otherwise sound playback will result in a NULL pointer dereference or other effect of uninitialized memory accesses (which was confirmed on SDM845 having similar issue).
EPSS: 0.002 (10.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Linux — versions 15c7fab0e0477d7d7185eac574ca43c15b59b015, 6.8, 0
- Linux Linux_kernel — versions 6.12
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-50105?
- CVE-2024-50105 is a medium-severity vulnerability in Linux, classified under NULL Pointer Dereference. CVSS score: 5.5/10. Published 2024-11-05.
- How severe is CVE-2024-50105?
- Medium severity. CVSS v3 base score is 5.5 out of 10.