Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() In the drain loop, the local variable 'runtime' is reassigned to a linked stream's runtime (runtime = s->runtime at line 2157). After releasing the stream lock at line 2169, the code accesses runtime->no_period_wakeup, runtime->rate, and runtime->buffer_size (lines 2170-2178) — all referencing the linked stream's runtime without any lock or refcount protecting its lifetime. A concurrent close() on the linked stream's fd triggers snd_pcm_release_substream() → snd_pcm_drop() → pcm_release_private() → snd_pcm_unlink() → snd_pcm_detach_substream() → kfree(runtime). No synchronization prevents kfree(runtime) from completing while the drain path dereferences the stale pointer. Fix by caching the needed runtime fields (no_period_wakeup, rate, buffer_size) into local variables while still holding the stream lock, and using the cached values after the lock is released.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f2b3614cefb61ee6046a0aaee503ee37f227d310 to < 9baee36e8c5443411c4629afabafaff8a46a23fdaffectedf2b3614cefb61ee6046a0aaee503ee37f227d310 to < f2cb2e0d27fb925c73a78f0ce7d6dbf68d3747c1affectedf2b3614cefb61ee6046a0aaee503ee37f227d310 to < fc71f888994569f87d5bee20b1ac6c9c1e3a7a79affectedf2b3614cefb61ee6046a0aaee503ee37f227d310 to < 629cf09464cf98670996ea5c191dc9743e6f3f00affectedf2b3614cefb61ee6046a0aaee503ee37f227d310 to < ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432affectedf2b3614cefb61ee6046a0aaee503ee37f227d310 to < 4a758e9a1f5ed722f83c4dd35f867fe811553bcbaffectedf2b3614cefb61ee6046a0aaee503ee37f227d310 to < c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694affectedf2b3614cefb61ee6046a0aaee503ee37f227d310 to < 9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6affected
Linux Linux
Default version status: affected
3.0affected0 to < 3.0unaffected5.10.253 to ≤ 5.10.*unaffected5.15.220 to ≤ 5.15.*unaffected6.1.167 to ≤ 6.1.*unaffected6.6.130 to ≤ 6.6.*unaffected6.12.78 to ≤ 6.12.*unaffected6.18.19 to ≤ 6.18.*unaffected6.19.9 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/9baee36e8c5443411c4629afabafaff8a46a23fd ↗
- https://git.kernel.org/stable/c/f2cb2e0d27fb925c73a78f0ce7d6dbf68d3747c1 ↗
- https://git.kernel.org/stable/c/fc71f888994569f87d5bee20b1ac6c9c1e3a7a79 ↗
- https://git.kernel.org/stable/c/629cf09464cf98670996ea5c191dc9743e6f3f00 ↗
- https://git.kernel.org/stable/c/ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432 ↗
- https://git.kernel.org/stable/c/4a758e9a1f5ed722f83c4dd35f867fe811553bcb ↗
- https://git.kernel.org/stable/c/c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694 ↗
- https://git.kernel.org/stable/c/9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 ↗