{"id":"CVE-2024-26654","state":"PUBLISHED","title":"ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: sh: aica: reorder cleanup operations to avoid UAF bugs\n\nThe dreamcastcard->timer could schedule the spu_dma_work and the\nspu_dma_work could also arm the dreamcastcard->timer.\n\nWhen the snd_pcm_substream is closing, the aica_channel will be\ndeallocated. But it could still be dereferenced in the worker\nthread. The reason is that del_timer() will return directly\nregardless of whether the timer handler is running or not and\nthe worker could be rescheduled in the timer handler. As a result,\nthe UAF bug will happen. The racy situation is shown below:\n\n      (Thread 1)                 |      (Thread 2)\nsnd_aicapcm_pcm_close()          |\n ...                             |  run_spu_dma() //worker\n                                 |    mod_timer()\n  flush_work()                   |\n  del_timer()                    |  aica_period_elapsed() //timer\n  kfree(dreamcastcard->channel)  |    schedule_work()\n                                 |  run_spu_dma() //worker\n  ...                            |    dreamcastcard->channel-> //USE\n\nIn order to mitigate this bug and other possible corner cases,\ncall mod_timer() conditionally in run_spu_dma(), then implement\nPCM sync_stop op to cancel both the timer and worker. The sync_stop\nop will be called from PCM core appropriately when needed.","publishedAt":"2024-04-01T08:35:19.763Z","updatedAt":"2026-08-05T11:26:33.368Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"eeb2a2ca0b8de7e1c66afaf719529154e7dc60b2","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"4206ad65a0ee76920041a755bd3c17c6ba59bba2","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"aa39e6878f61f50892ee2dd9d2176f72020be845","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"8c990221681688da34295d6d76cc2f5b963e83f5","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"9d66ae0e7bb78b54e1e0525456c6b54e1d132046","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"61d4787692c1fccdc268ffa7a891f9c149f50901","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"e955e8a7f38a856fc6534ba4e6bffd4d5cc80ac3","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"3c907bf56905de7d27b329afaf59c2fb35d17b04","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"051e0840ffa8ab25554d6b14b62c9ab9e4901457","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/sh/aica.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.23","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.23","versionType":"semver"},{"version":"4.19.312","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.274","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.215","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.154","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.84","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.24","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7.12","status":"unaffected","lessThanOrEqual":"6.7.*","versionType":"semver"},{"version":"6.8.3","status":"unaffected","lessThanOrEqual":"6.8.*","versionType":"semver"},{"version":"6.9","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/sh/aica.c"]}],"references":["https://git.kernel.org/stable/c/eeb2a2ca0b8de7e1c66afaf719529154e7dc60b2","https://git.kernel.org/stable/c/4206ad65a0ee76920041a755bd3c17c6ba59bba2","https://git.kernel.org/stable/c/aa39e6878f61f50892ee2dd9d2176f72020be845","https://git.kernel.org/stable/c/8c990221681688da34295d6d76cc2f5b963e83f5","https://git.kernel.org/stable/c/9d66ae0e7bb78b54e1e0525456c6b54e1d132046","https://git.kernel.org/stable/c/61d4787692c1fccdc268ffa7a891f9c149f50901","https://git.kernel.org/stable/c/e955e8a7f38a856fc6534ba4e6bffd4d5cc80ac3","https://git.kernel.org/stable/c/3c907bf56905de7d27b329afaf59c2fb35d17b04","https://git.kernel.org/stable/c/051e0840ffa8ab25554d6b14b62c9ab9e4901457","https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:10.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/26xxx/CVE-2024-26654.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-26654","state":"PUBLISHED","datePublished":"2024-04-01T08:35:19.763Z","dateUpdated":"2026-08-05T11:26:33.368Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-02-19T14:20:24.144Z"},"containers":{"cna":{"title":"ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: sh: aica: reorder cleanup operations to avoid UAF bugs\n\nThe dreamcastcard->timer could schedule the spu_dma_work and the\nspu_dma_work could also arm the dreamcastcard->timer.\n\nWhen the snd_pcm_substream is closing, the aica_channel will be\ndeallocated. But it could still be dereferenced in the worker\nthread. The reason is that del_timer() will return directly\nregardless of whether the timer handler is running or not and\nthe worker could be rescheduled in the timer handler. As a result,\nthe UAF bug will happen. The racy situation is shown below:\n\n      (Thread 1)                 |      (Thread 2)\nsnd_aicapcm_pcm_close()          |\n ...                             |  run_spu_dma() //worker\n                                 |    mod_timer()\n  flush_work()                   |\n  del_timer()                    |  aica_period_elapsed() //timer\n  kfree(dreamcastcard->channel)  |    schedule_work()\n                                 |  run_spu_dma() //worker\n  ...                            |    dreamcastcard->channel-> //USE\n\nIn order to mitigate this bug and other possible corner cases,\ncall mod_timer() conditionally in run_spu_dma(), then implement\nPCM sync_stop op to cancel both the timer and worker. The sync_stop\nop will be called from PCM core appropriately when needed."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"eeb2a2ca0b8de7e1c66afaf719529154e7dc60b2","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"4206ad65a0ee76920041a755bd3c17c6ba59bba2","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"aa39e6878f61f50892ee2dd9d2176f72020be845","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"8c990221681688da34295d6d76cc2f5b963e83f5","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"9d66ae0e7bb78b54e1e0525456c6b54e1d132046","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"61d4787692c1fccdc268ffa7a891f9c149f50901","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"e955e8a7f38a856fc6534ba4e6bffd4d5cc80ac3","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"3c907bf56905de7d27b329afaf59c2fb35d17b04","versionType":"git"},{"version":"198de43d758ca2700e2b52b49c0b189b4931466c","status":"affected","lessThan":"051e0840ffa8ab25554d6b14b62c9ab9e4901457","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/sh/aica.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.23","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.23","versionType":"semver"},{"version":"4.19.312","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.274","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.215","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.154","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.84","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.24","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7.12","status":"unaffected","lessThanOrEqual":"6.7.*","versionType":"semver"},{"version":"6.8.3","status":"unaffected","lessThanOrEqual":"6.8.*","versionType":"semver"},{"version":"6.9","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/sh/aica.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/eeb2a2ca0b8de7e1c66afaf719529154e7dc60b2"},{"url":"https://git.kernel.org/stable/c/4206ad65a0ee76920041a755bd3c17c6ba59bba2"},{"url":"https://git.kernel.org/stable/c/aa39e6878f61f50892ee2dd9d2176f72020be845"},{"url":"https://git.kernel.org/stable/c/8c990221681688da34295d6d76cc2f5b963e83f5"},{"url":"https://git.kernel.org/stable/c/9d66ae0e7bb78b54e1e0525456c6b54e1d132046"},{"url":"https://git.kernel.org/stable/c/61d4787692c1fccdc268ffa7a891f9c149f50901"},{"url":"https://git.kernel.org/stable/c/e955e8a7f38a856fc6534ba4e6bffd4d5cc80ac3"},{"url":"https://git.kernel.org/stable/c/3c907bf56905de7d27b329afaf59c2fb35d17b04"},{"url":"https://git.kernel.org/stable/c/051e0840ffa8ab25554d6b14b62c9ab9e4901457"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through the ALSA PCM character device `/dev/snd/pcmC0D0p` via open/ioctl(PREPARE,START)/close on the local system. There is no network-facing path into the Dreamcast AICA driver.\nAC:L - The attacker drives both sides of the race — arming the self-rearming timer/work pair with TRIGGER_START and then closing the substream — and the timer rearms every jiffy, so the window recurs continuously and a tight open/start/close loop wins it reliably. No condition outside the attacker's control is required.\nPR:L - Only a local unprivileged account with access to the sound device node is needed (audio group or console-user ACL); no capability, CAP_SYS_ADMIN, or root check exists anywhere on the `snd_pcm_release_substream()` → `snd_aicapcm_pcm_close()` path.\nUI:N - The attacking process performs every step itself — opening the PCM device, starting playback, and closing it — with no action from any other user.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Use-after-free on a kmalloc-32 object: `startup_aica()` reads all 32 bytes of the freed `struct aica_channel` and DMAs them into SPU memory, and the freed slot can be groomed to hold attacker-selected reclaimed kernel objects, giving a path to kernel memory disclosure.\nI:H - `run_spu_dma()` performs `dreamcastcard->channel->flags |= 0x01` on freed memory — a read-modify-write into a reclaimed kmalloc-32 object the attacker can heap-spray, yielding a controlled write primitive usable for privilege escalation.\nA:H - The revived worker also dereferences `dreamcastcard->substream` after close sets it to NULL, giving a deterministic oops, and the UAF itself corrupts slab state leading to kernel panic."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:26:33.368Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"4.19.312"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"5.4.274"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"5.10.215"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"5.15.154"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"6.1.84"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"6.6.24"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"6.7.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"6.8.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"6.9"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/eeb2a2ca0b8de7e1c66afaf719529154e7dc60b2","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/4206ad65a0ee76920041a755bd3c17c6ba59bba2","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/aa39e6878f61f50892ee2dd9d2176f72020be845","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/8c990221681688da34295d6d76cc2f5b963e83f5","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/9d66ae0e7bb78b54e1e0525456c6b54e1d132046","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/61d4787692c1fccdc268ffa7a891f9c149f50901","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/e955e8a7f38a856fc6534ba4e6bffd4d5cc80ac3","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/3c907bf56905de7d27b329afaf59c2fb35d17b04","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/051e0840ffa8ab25554d6b14b62c9ab9e4901457","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T00:07:19.846Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-26654","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T15:53:59.432754Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-11T17:33:42.392Z"}}]}}}