What’s Vulnerable › Vulnerabilities

CVE-2024-50160: ALSA: hda/cs8409: Fix possible NULL dereference

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-07 · updated 2026-06-17
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs8409: Fix possible NULL dereference If snd_hda_gen_add_kctl fails to allocate memory and returns NULL, then NULL pointer dereference will occur in the next line. Since dolphin_fixups function is a hda_fixup function which is not supposed to return any errors, add simple check before dereference, ignore the fail. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected products

• Linux kernel: from 5.15 before 5.15.170; from 5.16 before 6.1.115; from 6.2 before 6.6.59; from 6.7 before 6.11.6; 6.12-rc1, 6.12-rc2, 6.12-rc3 — fixed in 5.15.170, 6.1.115, 6.11.6, 6.6.59

How to fix

Upgrade to a fixed version: Linux kernel 5.15.170, 6.1.115, 6.11.6, 6.6.59. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/21dc97d5086fdabbe278786bb0a03cbf2e26c793
• https://git.kernel.org/stable/c/4e19aca8db696b6ba4dd8c73657405e15c695f14
• https://git.kernel.org/stable/c/8971fd61210d75fd2af225621cd2fcc87eb1847c
• https://git.kernel.org/stable/c/a5dd71a8b849626f42d08a5e73d382f2016fc7bc
• https://git.kernel.org/stable/c/c9bd4a82b4ed32c6d1c90500a52063e6e341517f
• https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Get alerted when CVE-2024-50160 or the next vulnerability affects your stack