What’s Vulnerable › Vulnerabilities

CVE-2024-38551: ASoC: mediatek: Assign dummy when codec not specified for a DAI link

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-19 · updated 2026-06-17
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: Assign dummy when codec not specified for a DAI link MediaTek sound card drivers are checking whether a DAI link is present and used on a board to assign the correct parameters and this is done by checking the codec DAI names at probe time. If no real codec is present, assign the dummy codec to the DAI link to avoid NULL pointer during string comparison.

Affected products

• Linux kernel: from 6.3 before 6.6.33; from 6.7 before 6.8.12; from 6.9 before 6.9.3 — fixed in 6.6.33, 6.8.12, 6.9.3

How to fix

Upgrade to a fixed version: Linux kernel 6.6.33, 6.8.12, 6.9.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0c052b1c11d8119f3048b1f7b3c39a90500cacf9
• https://git.kernel.org/stable/c/5f39231888c63f0a7708abc86b51b847476379d8
• https://git.kernel.org/stable/c/87b8dca6e06f9b1681bc52bf7bfa85c663a11158
• https://git.kernel.org/stable/c/cbbcabc7f0979f6542372cf88d7a9da7143a4226
• https://git.kernel.org/stable/c/0c052b1c11d8119f3048b1f7b3c39a90500cacf9
• https://git.kernel.org/stable/c/5f39231888c63f0a7708abc86b51b847476379d8
• https://git.kernel.org/stable/c/87b8dca6e06f9b1681bc52bf7bfa85c663a11158
• https://git.kernel.org/stable/c/cbbcabc7f0979f6542372cf88d7a9da7143a4226

Get alerted when CVE-2024-38551 or the next vulnerability affects your stack